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NASA STI Program ... in Profile 


Since its founding, NASA has been dedicated to 
the advancement of aeronautics and space science. 

The NASA scientific and technical information (STI) 
program plays a key part in helping NASA maintain 
this important role. 

The NASA STI program operates under the 
auspices of the Agency Chief Information Officer. It 
collects, organizes, provides for archiving, and 
disseminates NASA’s STI. The NASA STI program 
provides access to the NASA Aeronautics and Space 
Database and its public interface, the NASA Technical 
Report Server, thus providing one of the largest 
collections of aeronautical and space science STI in 
the world. Results are published in both non-NASA 
channels and by NASA in the NASA STI Report 
Series, which includes the following report types: 

• TECHNICAL PUBLICATION. Reports of 
completed research or a major significant phase 
of research that present the results of NASA 
programs and include extensive data or 
theoretical analysis. Includes compilations of 
significant scientific and technical data and 
infonnation deemed to be of continuing 
reference value. NASA counterpart of peer- 
reviewed formal professional papers, but having 
less stringent limitations on manuscript length 
and extent of graphic presentations. 

• TECHNICAL MEMORANDUM. Scientific 
and technical findings that are preliminary or of 
specialized interest, e.g., quick release reports, 
working papers, and bibliographies that contain 
minimal annotation. Does not contain extensive 
analysis. 

• CONTRACTOR REPORT. Scientific and 
technical findings by NASA-sponsored 
contractors and grantees. 


• CONFERENCE PUBLICATION. Collected 
papers from scientific and technical 
conferences, symposia, seminars, or other 
meetings sponsored or co-sponsored by NASA. 

• SPECIAL PUBLICATION. Scientific, 
technical, or historical information from NASA 
programs, projects, and missions, often 
concerned with subjects having substantial 
public interest. 

• TECHNICAL TRANSLATION. English- 
language translations of foreign scientific and 
technical material pertinent to NASA’s mission. 

Specialized services also include creating custom 

thesauri, building customized databases, and 

organizing and publishing research results. 

For more information about the NASA STI 

program, see the following: 

• Access the NASA STI program home page at 
http://www.sti. nasa.gov 

• E-mail your question via the Internet to 
help@sti.nasa.gov 

• Fax your question to the NASA STI Help Desk 
at 443-757-5803 

• Phone the NASA STI Help Desk at 
443-757-5802 

• Write to: 

NASA STI Help Desk 

NASA Center for AeroSpace Information 

7115 Standard Drive 

Hanover, MD 21076-1320 
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Appendix A. Stakeholder Request (November 2008) 


National Aeronautics and 
Space Administration 

Lyndon B. Johnson Space Center 
2101 NASA Parkway 
Houston, Texas 77058-3696 

October 21, 2008 


LaRC-Cl /Director, NASA Engineering and Safety Center (NESC) 
EA/Director, Engineering 

Request for CEV Parachute Assembly System (CPAS) Reliability Analysis 


In support of the Constellation Program, JSC Engineering is responsible for developing and 
delivering the CPAS as Government-furnished equipment. To date, the Orion Safety, 

Reliability and Quality Assurance Team has generated CPAS reliability estimates based on 
historical data from other parachute systems such as the Shuttle solid rocket booster recovery 
system. The Orion Engineering Review Board held September 29-30, 2008, which addressed 
the preliminary design status of all CEV systems, identified CPAS as the principal driver for 
overall Orion reliability based on this estimate. The CPAS project is reviewing and modifying 
this estimate to incorporate our internal parachute expertise. 

Given the criticality of the CPAS, I request the NESC to review the reliability analysis of the 
CPAS in the context of the existing design and planned development program and to make 
recommendations for improving either if appropriate. Of particular interest is the planned 
development test program due to its value in uncovering design flaws contrasted with the cost 
and resources required. Striking the proper balance between reliability enhancing tests and 
total project cost and schedule is important for the success of the Program. 

The ability of your organization to engage both internal NASA and external military and industry 
expertise and knowledge for this activity would be invaluable. This comprehensive analysis 
could identify design and/or process improvement opportunities to increase the overall reliability 
of the CPAS, as well as to ensure success of the integrated system. 

Please contact me directly for any questions at (281) 483-1396, or at my e-mail address 
steohen.i.altemus@nasa.gov . 


Stephen J. Altemus 


Reply to Attn of: 


EA-08-030 

TO: 

FROM: 

SUBJECT: 
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Appendix B.l. Stakeholder Outbrief of Interim Recommendations 1 

(April 2009) 

The attached version of Stakeholder Outbrief 1 differs slightly from that which was approved by 
the NRB. Figures included to facilitate board member understanding were removed in the 
stakeholder package. 


NESC Review Board 


Mike Kelly 


April 16,2009 


Crew Exploration Vehicle (CEV) 
Parachute Assembly System (CPAS) 
Independent Reliability Assessment 

Stakeholder Outbrief of Interim Recommendations 

Project Assessment between December 2008 and March 2009 


Mike Kelly 

NESC Principal Engineers Office 

April 21, 2009 


NESC Request No: TI-08-00487 


This briefing is for status only and does not represent complete engineering data analysis 


1 


NESC Request No.: 08-00487 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

5 of 156 


NASA Engineering & Safety Center 


Mike Kelly 


April 16, 2009 


In 2003, the Columbia Accident Investigation Board (CAIB) observed that NASA's safety 
organization lacked adequate technical expertise and resources for independent technical 
reviews of NASA's Programs and Projects. 

The NASA Engineering & Safety Center (NESC) was formed as a response to this observation, 
with a mission to provide the Agency’s Programs and Projects with rigorous independent 
technical perspectives on their most critical technical issues. 

NESC is independent: 

- Centrally managed and funded through the Office of Chief Engineer. 

- Unaffiliated with the Programs our teams evaluate. 

- Unbiased by any specific NASA Center. 

- Has an independent engineering chain of command to assure an avenue for 
consideration of all points of view. 

NESC teams are broad-based: 

- Experts from all ten NASA Centers and HQ 

- About one-quarter of NESC team members are from outside the Agency 

• Industry 

• Academia 

• Other U.S. Government Agencies & National Labs 


This briefing is for status only and does not represent complete engineering data analysis 
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NASA Engineering & Safety Center 


Mike Kelly 


April 16, 2009 


NESC teams engage in a variety of activities: 

• Conduct technical assessments of high risk issues by reviewing data and/or performing 
independent testing and analysis to create new data, creating data-driven findings and 
observations, and generating solution-driven, preventative or corrective 
recommendations that are rigorously grounded in team findings and observations. 

• Engage in forward-looking technical investigations, which may include performing 
independent tests and analyses with high potential to advance knowledge within a 
discipline. 

• Perform design development and demonstration work, which may include conducting 
design trade studies, performing preliminary design definition, weights trades, 
structural analyses, systems analyses, detailed design work, design integration work, 
and constructing full-scale test articles for laboratory and flight testing. 
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NASA Engineering & Safety Center 


Mike Kelly 


April 16,2009 


NESC teams persist virtually as networks of 
technical expertise, even after assessments 
are completed, becoming an enduring asset 
for NASA Programs and Projects. 
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Agenda 


Mike Kelly 


April 16, 2009 


• Background 

• Team Listing 

• Recommendations 
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Background 


Mike Kelly 


April 16, 2009 


• The NESC independent CPAS reliability assessment team was 
chartered to assess the project’s preliminary design, its preliminary 
estimates for reliability, and its preliminary developmental test 
program. 

- The stakeholder requested a “comprehensive analysis (that) could 
identify design and/or process improvement opportunities to increase 
overall reliability of the CPAS, as well as ensure success of the 
integrated system.” 

- Complete stakeholder request is in backup charts. 

• The team is comprised of parachute system design and test 
experts, statistics and reliability analysis and test experts, and 
select discipline experts. 

• A final report of Findings, Observations and Recommendations is 
planned for August 2009. 
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Background 


Mike Kelly 


April 16, 2009 


• The “period of initial review” was from December 2008 through 
March 2009. 


• During this three-month period: 

- The CPAS Subsystem team was clearly working very hard and with 
determination to establish an architecture and a set of requirements 
that would result in a robust and reliable design, given a very complex 
design problem with many competing parameters. 

- Design details and requirements evolved significantly and rapidly. 

- PDR was delayed from June 2009 to (est) August or September 2009. 

• The NESC team reviewed material from CPAS teleconferences and 
other material that was provided directly by the project upon 
request. 

- Documents and presentations reviewed by the team are listed in 
Backup charts. 
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Background 


Mike Kelly 


April 16, 2009 


• The NESC team discussed the various design architectures under 
consideration. The team also discussed the available reliability 
estimates and methods employed. 

• CPAS had not established development test plans or a verification 
and validation matrix to a sufficient degree to provide to the NESC 
team for review. 

- Since test plan review was a key team objective, the team revised its 
schedule of assessment tasks to accommodate (Change approved by 
the NESC Review Board on 3-26-09). 

- The NESC team plans to remain engaged with the Project at a reduced 
rate between April and June 2009, and increase its engagement during 
June 2009, or whenever a stable design architecture is in place, and 
preliminary development test plans are available for assessment. 
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Background 


Mike Kelly 


April 16, 2009 


• Interim Recommendations are directed towards the CPAS 
Subsystem team, unless otherwise indicated. 

• Stakeholder Outbrief of these Interim Recommendations is 
intended to help lower technical and schedule risk in the current 
pre-PDR development phase. 

• There are 30 Interim Recommendations; the first 12 are considered 
a top priority for action as soon as practical. 
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Background 


Mike Kelly 


April 16, 2009 


• The following acronyms apply to design architectural options that 
were under consideration during the period of initial review. 

• RAO = Rigidly Attached Option 

• LAO = Loosely Attached Option 

• PDO = Pilot Deployed Option (Loosely Attached Pilots) 

• 3PA = Harnessed Mains 

• SPA = Single Point Attach Mains 


This briefing is for status only and does not represent complete engineering data analysis 
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Team Listing 


Mike Kelly 


April 16,2009 


Last Name 

First 

Name 

Discipline 

Organization location 

Email Address 

Kelly 

Michael 

Team Lead 

NASA, LaRC 

michael.j.kelly-l@nasa.gov 

Jambulingam 

Natesan 

Reliability Sub-team Lead 

NASA Safety Center 
(NSC), GRC 

natesan. jambulingam@nasa. gpv 

Cruz 

Juan 

Parachute Systems 

NASA, LaRC 

juan.r.cruz@nasa.gpv 

Hengel 

Jack 

Parachute Systems 

NASA, MSFC 

jack.hengpl@nasa.gov 

Snyder 

Karma 

Systems Engineering 

NASA, SSC 

karma. k.snyder@nasa.gov 

Parker 

Pete 

Reliability 

NASA, LaRC 

peter.a.parkei@nasa.gpv 

Thomas 

Walt 

Reliability 

NASA. GSFC 

waiter .b thomas@nasa.gov 

Huegel 

Fred 

Electrical 

NASA, GSFC 

frederick. g.hue gel@nasa. gpv 

Contractor 

Membership 





Behr 

Vance 

Parachute Systems 

Sandia National 
Laboratory (SNL) 

vlbehr@sandia. gpv 

Heir 

Michael 

Parachute Systems 

Naval Air Warfare 
Center Weapons 
Division (NAWCWD), 
China Lake 

michael.hen@navy.mil 

West 

Bob 

Parachute Systems 

Science Applications 
International 
Corporation (SAIC) 

b west@earthlink.net 

Hillebiandt 

Dave 

Parachute Systems 

United Space Alliance 
(USA), KSC 

frederick.d.hillebrandt@nasa.gpv 

Womack 

Jim 

Reliability 

Aerospace Corporation 
(AC) 

james .m. womack@aero .org 1 

Vitullo 

Nick 

Mechanical/Structures 

ATK, LaRC 

nicholas vitulb@atk.com 

Won 

Gary 

Electrical 

ATK, GSFC 

gary.k.won@nasa.gov 

Shidner 

Jeremy 

Systems Engineering 

Analytical Mechanics 
Associates (AMA), 
LaRC 

jeremy .d.shidner@nasa. gov 

Consultants.'Peer 

Reviewers 





Yuchnovicz 

Dan 

Parachute Systems 

NASA, LaRC 

daruel.e yuchnovicz@nasa. gpv 

Johnson 

Ken 

Reliability (NEST) 

NASA, GRC 

kenneth.g.johnson@nasa. gpv 

Lee 

Wayne 

Parachute Systems 

NASA, JPL 

wayne . j .lee@jpl.nasa.gpv 

Support 





Burgess 

Linda 

Planning and Control 
Analyst 

ATK, LaRC 

linda.i.burgess@nasa. gov 

Dunn-Pittman 

Tina 

Project Coordinator 

ATK, LaRC 

tina.m.dunn@nasa.gov 

Johnson 

Loutricia 

MTSO Program Analyst 

NASA, LaRC 

butricia.s.johnson@nasa.gov 

Snare 

Carolyn 

Technical Writer 

ATK. LaRC 

carolyn.c.snare@nasa.gov 
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Recommendations 


Action recommended as soon as practical - 


R-1: Create a consistent, clear methodology to generate reliability 
estimate uncertainties. (0-1) 

• When reliability estimates are communicated to stakeholders, uncertainty estimates 
should be included, with an explanation that these uncertainties will be large for pre- 
PDR design architectures. 

R-2: Establish a reliability budget. (0-2) 

R-3: Evaluate the use of a volume budget for the forward bay to manage 
main parachute pack volume growth before and after PDR. 

(F-1, F-2, 0-3) 


R-4: Orion Project should reassess if the current forward bay volume 
allocation is sufficient to generate a reliable CPAS design. 

(0-4, 0-24) 
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Recommendations 


Action recommended as soon as practical - 


R-5: Apply a comprehensive systems approach to the design 
development, analysis, and testing efforts. (0-5) 

• Address risks with priority given to those identified by the FTA to have the highest 
uncertainties (“risk balancing"). 

• Include component-level verification tests to aid in tracking requirements compliance 
and risk acceptance/mitigation. 

• Include planned means for verification and validation of simulation models. 


*NESC Report, DDT&E attached. 
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Recommendations 


Action recommended as soon as practical - 


R-6: Use verified and validated analysis codes to generate reliability 
estimates. (F-3, 0-6) 

• Review the techniques and assumptions analysts made when building DCLDYN analytical 
models, and the validity and method of derivation of the distributions from the CPAS Gen-1 
data or all pertinent input parameters. 

• Characterize the limitations of the DCLDYN code’s features, heritage, and the applicability of 
validation test data. 

• Cross-check between analysis codes (e.g., DCLDYN and DSS) to characterize their 
capabilities, assumptions, and limitations. 

R-7: Adopt a single, configuration-controlled document for distributing 
CPAS simulation parameters to other Orion Project Analysis Teams. 
(F-4) 

• With appropriate traceability. 

• Maintained in a common location 

• System definitions and data should be kept in data formats that are easily updated 
and read 
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Recommendations 


Action recommended as soon as practical - 


R-8: S&MA and Design team members should more actively integrate 
their tasks and activities. (F-5, 0-7) 

• Possible methods to increase coordination could include conducting more frequent 
and focused teleconferences, increasing the use of electronic networking tools, 
and/or periodic co-location between members from both teams. 

R-9: Assess the merits of assigning a Systems Engineer as a “Phase 
Lead” with a dedicated responsibility for oversight of interfaces and 
integration with other subsystems. (F-6, 0-8) 

• Consider the following possible roles and relationships for the Phase Lead: 

• Report to the SE&I Team Chair. 

• Be assigned an “ownership” of aspects of CPAS that cross interfaces. 

• Have regular interaction with other subsystems organizations and management, 
with freedom to move across subsystem, system and project office boundaries to 
ensure overall EDL success. 

• Be empowered to assess the effects of proposed CPAS design changes on other 
subsystems that interface with CPAS, and vice versa, and to negotiate changes 
with other subsystems. 

1 5 
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Recommendations 


Action recommended as soon as practical - 


R-10: Conduct comprehensive ground tests to assess the risk of damage to 
drogue and main parachute components from Near-Field contact 
with CM and FBC structure. (F-7, 0-9) 

• Require a mockup with representative geometric details of the CM including all protrusions 
on the OML and in the forward bay. 

• Address risks to parachute components from: 

• D-bag contact with CM and FBC structure during extraction from stowage. 

• Direct contact with CM and FBC structure. 

• Rapid extraction from a d-bag due to d-bag extraction hindrance. 

• Direct contact with potentially sharp edges of separation surfaces including LAS 
Wells, drogue mortar tubes, and the LIDS Ring. 

• Pre-test planning for contact tests should include: 

• Assessment of risks from relative motion between parachute components and 
structure along any combination of three axes: drag across, slide along or strike 
against. 

• Assessment of risks of any contact with CM surfaces that may be residually hot after 
reentry. 
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Recommendations 


Action recommended as soon as practical - 


R-11: Assess the risk quantitatively, that components from more than one 
main parachute could be damaged by Far-Field contact with the FBC 
( 0 - 10 ) 

R-12: Establish a comprehensive process for testing and evaluating the 
parachute structural joint efficiencies. (0-11) 

• The process should include fabrication of sample joints, environmental 
conditioning, and structural testing. 
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Recommendations 


Additional recommendations - 


R-13: Discontinue use of SRB data to generate estimates for the 

probability of Near-Field contact of main parachute components with 
the CM and FBC structure. (F-8) 

R-14: Utilize applicable data from the geometrically similar Apollo 

Program ELS to generate estimates for the probability of Near-Field 
contact of main parachute components with the CM and FBC 
structure. (F-9) 

• When Apollo Program ELS data is not available, conduct original analyses and tests 
to generate data for reliability estimates for Near-Field contact. 

R-15: Maintain only one fault tree for CPAS FTA. (F-10) 

R-16: Review the sufficiency, applicability, and limitations of reliability 
estimates that were generated using the load/material property 
distribution-intersection method and assess from this review whether 
additional material testing is indicated. (F-11, 0-12) 

1 8 
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Recommendations 


Additional recommendations - 


R-17: Consider the following PTRS modifications. (F-12) 

• Specify a complete set of initial conditions for drogue mortar firing. 

• Specify limits to the parachute peak load directions. 

• Directed requirement revisions: 

> [I. CPAS. CM. 006] in a statistically verifiable form. 

> [I. CPAS. CM. 011] to include the nominal condition. 

A [R. CPAS. 012] to include the assumed status (i.e., operational, non-operational, or both 
cases must be considered) of the parachute that had a skipped reefed stage. 

> [R.CPAS.012] in terms of percentiles. 
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Recommendations 


Additional recommendations - 


R-18: Select a pack shape that is as geometrically simple as possible. (F-13) 

• Minimize geometric features that result in packing into sloping surfaces. 

R-19: Assess using a uniform retention and simple release system 
conceptually similar to the Apollo ELS Block II design. (F-14) 

R-20: Develop pack inspection methods integrally with packing procedures, 
and retain procedure developers as packers and inspectors for 
operational vehicles. (F-15, F-16) 

R-21: Characterize the effectiveness of X-Ray NDI with representative pack 
shapes and packing densities. (F-17, 0-13, 0-3) 
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Recommendations 


Additional recommendations - 


R-22: Investigate alternative/complementary NDI methods to assure reefing 
system integrity after packing. (0-14) 

R-23: Assess if fabric curtains or foam materials could prevent damage to 
CPAS main parachute components during deployment. (RAO only) 
(F-18, 0-15) 

R-24: Search applicable lessons learned databases for packing procedures 
that can mitigate reliability risks. (0-16) 

R-25: Assess the risks quantitatively of a single instance of TPS damage 
causing damage to a drogue harness leg from each drogue harness. 
(0-17) 

• Consider redundant drogue harness leg TPS protection such as 
aluminized fiberglass sleeves. 
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Recommendations 


Additional recommendations - 


R-26: Include redundant and independently engaged kicker straps for 
each main d-bag, if kicker straps become baseline. (0-18, 0-19) 

R-27: Quantitatively assess the probability of main parachute 
entanglement during deployment, for abort and reentry. 

(RAO, LAO, PD0)(F-19) 

R-28: Assess by analysis and test the damage tolerance and residual 
strength of Kevlar® risers and suspension lines and canopy 
structural components with different types of damage that may be 
inflicted by Far-Field FBC contact. (0-10) 
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Recommendations 


Additional recommendations - 


R-29: Consider the following specific tests for inclusion in the 

comprehensive test plan. Candidate tests are organized by rigging, 
ground, air, and lab tests. (F-20, 0-20) 

[List of tests and objectives is in Backup charts] 

R-30: Critically reassess if a failed main parachute is an independent 
event following a failed drogue parachute. (0-21, 0-22) 

• Assessment results are needed to support the CPAS decision to change the 

pad abort failure tolerance requirement from 'one failed drogue and one failed main,’ 
to 'one failed drogue or one failed main.’ 
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Lesson Learned 


Mike Kelly 


April 16, 2009 


LL-1 : NASA Programs and Projects should not rely on contractors reports 
surviving, but rather should document development efforts 
themselves and store them in a topic-specific or discipline-specific 
Agency repository (0-23). 
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Backup 


Mike Kelly 


April 16, 2009 
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Backup - List of Specific Tests 

Mike Kelly 

Recommended for Consideration in R-29 

April 16, 2009 


Rigging tests : 

• to provide data to help establish the probability of damage that can result from mis-rigging 

• to demonstrate the ability, using various NDI methods, to detect mis-rigging 

Structural proof and ultimate load tests (coordinated with Lockheed) 

■ FBC attach fitting for two drogue harness legs, with the most adverse loading conditions as 
determined by analyses, to assure that one failed attachment does not fail its mate. 

• CM Gusset attach fitting for three main risers, with the most adverse loading conditions as 

Ground tests to anchor any modeling and simulation results that are used to generate quantitative 
reliability estimates and to characterize the following risks: 

• Characterize drogue mortar performance under adverse conditions to assure there is sufficient 
mortar energy to get the drogue d-bag out of the tube with sufficient velocity to get it far enough 
into the air stream to begin inflating. 

> Adverse conditions may include but are not limited to, adverse attitude of the Orion capsule, 
aged packed drogue parachute including riser, and loss of a single initiator. 

> Establish the optimal method for placement of the metallic drogue confluence ring in the 
drogue mortar, to minimize the risk of damage to the mortar's edge and subsequent damage to 
the drogue fabric. 
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Backup - List of Specific Tests 

Mike Kelly 

Recommended for Consideration in R-29 

April 16, 2009 


Ground tests (continued): 

• Characterize the risks of Near-Field contact of main d-bags with the FBC structure with kicker straps. 

• Validate analyses of main d-bag rigid body motion in response to extraction forces, to characterize the 
risk of main d-bag contact with the tunnel during extraction. 

• Characterize the performance of energy modulators at representative rates of extension. (LAO) 

• Demonstrate the reliable extraction, deployment, function, and robustness of the rotation torque limiter 
and its components, in nominal and adverse conditions. 

• Ground tests to characterize the effect on torque limiter function from one failed riser (or harness leg). 
(3PA, SPA) 

• Validate analyses of the effect peak local stresses on risers (or harness legs) from maximum expected 
number of twists, plus a margin. (3PA, SPA) 

• Demonstrate the reliable extraction of the contents from any stowage container, under adverse 
conditions, without damage to the contents or liberation of the container. 

• Demonstrate the reliable extraction of the contents from all drogue, pilot and main bags, with secondary 
objective to characterize the risks of burn damage for Nylon®, Kevlar®, and especially Vectran® 
parachute components. 
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Backup - List of Specific Tests 

Mike Kelly 

Recommended for Consideration in R-29 

April 16, 2009 


Air drop tests to anchor any modeling and simulation results that are used to generate quantitative 
reliability estimates and characterize the following risks: 

• Verify and certify all parachute structural margins 

• Early attention to the main parachute vent hoop element, which preliminary results show 
has a low DF and low reliability estimate. 

• Demonstrate the reliable extraction of the contents from all drogue, pilot and main d-bags. 

• Drogue confluence rings impacting each other during deployment. 

• Pilot parachute entanglement during deployment. (PDO) 

• Main parachute entanglement during deployment. (RAO, LAO) 

• Characterize parachute opening characteristics, including an assessment of cluster opening effects. 

• Characterize parachute disreefing loads 

• DCLDYN Monte Carlo analyses predicted to potentially exceed design load 
requirements, represents high uncertainty. 

• Characterize the effect of the wake from the Orion capsule on the deployment of the parachute 
system. 

• Characterize the performance of energy modulators. (LAO) 

• Demonstrate the reliable extraction, deployment, function, and robustness of the rotation torque 
limiter and its components, in nominal and adverse conditions. 

• Deployment tests of auxiliary chutes using a representative boilerplate FBC, to verify and validate 
the reliability of the auxiliary chute system (opening reliability in airspeed, entanglement). 
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Backup - Stakeholder Request 


Mike Kelly 


April 16, 2009 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16, 200£ 

F-1: The CPAS Subsystem’s Project Technical Requirements 

Specification (PTRS) specifies that the “CM is required to provide 
volume to ensure CPAS main parachute packing density is less 
than or equal to 38 lbm/ft 3 ,” but the projected pack density for the 
main parachute is currently projected to be between 43.7 and 54.2 
lbm/ft 3 , depending on certain design options. 

F-2: The amount of observed damage to Apollo ELS Block II parachute 
components increased during development in proportion to 
increases in pack density. 
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■ | ■ o I . ■ Mike Kell 

Findings & Observations 

w April 16, 20' 

F-3: DCLDYN mis-predicted opening load and inflation times for pilots, 
drogues, and mains during Gen-1 testing. DSS was used to 
correlate some Gen-1 test data, but Gen-1 test reports did not 
include direct comparisons of DSS data with DCLDYN data. 


F-4: CPAS Design Team data and contemporary data from other 
sources are inconsistent. 

- IDR charts (revised Feb 2009) and charts from the LM ERB Orion-09-0355 
(Mar 12, 2009) each show the main canopies’ combined drag coefficient 
as 0.94 for 2 chutes and 0.97 for 3 chutes, but the ODAC-3 Parachute 
Model Memo, CEV-LRS-08-004 Rev A (Jan 2009), pg 11, shows the main 
canopies’ combined drag coefficient as 0.718 for 2 chutes and 0.896 for 3 
chutes. 

- IDR charts (revised Feb 2009) show the Drogue risers to be 65.4 ft. long, 
but CEV-LRS-08-004 Rev A (Jan 2009), “ODAC-3 Parachute Model 
Memo” pg 10, shows the riser lengths to be 48.8 ft long 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16, 200£ 

F-5: The CPAS functional organization is complex, matrixed and 
geographically dispersed. Contractor Jacobs ESCG has the 
principal Safety and Mission Assurance (S&MA) responsibilities 
and Airborne Systems has the principal Design Development 
responsibilities. 

F-6: There were no references to application of NASA SP-2007-6105, 
NASA Systems Engineering Handbook or NPR 7123. 1A, NASA 
Systems Engineering Processes and Requirements in the material 
reviewed by the NESC team. 
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Findings & Observations 


F-7: The CPAS design poses risk of Near-Field contact of main d-bags, 
Near-Field contact of main parachute components during 
extraction from d-bags, and Near-Field contact of main parachute 
components during deployment. 

F-8: Solid Rocket Booster (SRB) experience data is inapplicable for 
generating reliability estimates of Near-Field contact of CPAS 
main parachute components with the CPAS Crew Module (CM) 
structure (RAO, LAO, PDO) or with the Forward Bay Cover (FBC) 
structure (LAO, PDO), because the SRB and its frustum are 
geometrically dissimilar to the CPAS CM and its FBC. 

F-9: Apollo Earth Landing System (ELS) experience data is applicable 
for generating reliability estimates for Near-Field contact of CPAS 
main parachute components with CM structure (RAO, LAO, PDO) 
and FBC structure (LAO, PDO), because of the geometric 
similarity of the Apollo CM and its Forward Heat Shield (FHS), to 
the CPAS CM and its FBC. 

- The Apollo data is inapplicable for Near Field contact with FBC structure 
for RAO. 
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■ | ■ o I . ■ Mike Kelly 

Findings & Observations 

w April 16, 200 

F-1 0: The CPAS S&MA Team is maintaining more than one fault tree 
for different purposes, creating risks of inadvertent omission or 
inappropriate inclusion of faults as the system rapidly evolves 
approaching PDR. 

F-1 1 : The CPAS Design Team (Airborne) generates reliability 

estimates for parachute component failures using a load/material 
property distribution-intersection reliability estimation method, 
and provides them to the CPAS S&MA Team (Jacobs) for 
inclusion in the CPAS Subsystem team’s FTA. 
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Findings & Observations 


F-12: Some CPAS requirements are incomplete, unspecific, or unclear. 

- [I. CPAS. CM. 006] CPAS shall limit the vertical descent rate of the CM to 
less than 10.07 m/s (33.0 ft/s) at standard sea-level conditions (as defined 
in NASA-TM-X-74335, U.S. Standard Atmosphere, 1976) fora maximum 
CM mass of 9,464.2 kg (20,865.0 Ibm). 

- [I. CPAS. CM. 01 1] CPAS shall limit the peak total parachute load (3-sigma) 
to less than the peak loads defined in Table 3.3-1, Parachute Peak Loads, 
under all fault conditions defined in [R. CPAS. 018], [R. CPAS. 017], and 

[R. CPAS. 129]. 

- [R. CPAS. 01 2] CPAS shall design to meet or exceed the load dispersions 
for each fault case defined in Table 3.3-2, Parachute Load Dispersions. 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16,2005 

F-1 3: The irregular shape of the CPAS main deployment bags (d-bags), 
with concavities and acute corners, and the location of their 
closure flaps on their bottom, pose risks of damage to parachute 
components from packing into sloping or complex surfaces. 
Irregular shapes also necessitate complex retention schemes. 

F-1 4: The complexity of the main d-bag’s retention release system 
poses risks of failure of the d-bag to be extracted, premature 
release, or hindrance of the d-bag’s extraction, all of which can 
result in the loss of a main parachute. 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16, 200! 

F-15: Several sources cite rigging and packing errors as the principal 
source of parachute deployment failures. The Project estimates 
deployment failure due to rigging error for the main parachutes at 
1 : 20 , 000 . 

F-16: The Apollo ELS packing procedures were developed during the 
qualification program and imposed throughout the operational 
program. The mitigation of reliability risks that can derive from 
rigging and packing errors was were mitigated in part by the 
transfer of personnel who developed the procedures into 
positions of operational inspection. 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16, 2009 

F-17: The Project makes an unqualified assessment that there is a 
“remote” chance of failing to detect a damaged reefing ring or 
prematurely triggered reefing line cutter using pre-flight X-Ray 
Non Destructive Inspections (NDI). The project estimates the risk 
of skipped reefing stage at 1:200,000. 

F-18: Fabric curtains and foam materials installed inside the SRB 
frustum mitigate the risk of SRB main parachute components 
being damaged by dragging along and striking against the SRB 
frustum and Main Parachute Support Structure (MPSS) bipod 
struts during deployment. 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16,2005 

F-19: The CPAS S&MA Team uses an oversimplified method to 
estimate the risk of main parachute entanglement during 
deployment after FBC release, considering CM rolling, but not 
pitching. 

- The CPAS team assigns the probability of entanglement at 1 : 1 ,000,000 
based on an estimate that the CM will not roll more than 240 degrees in an 
estimated 3 seconds between FBC release and main parachute line 
stretch. (RAO, LAO) 

- No distinction was made between entanglement risks following reentry and 
pad abort. 

- No CPAS estimate was reviewed for the probability of entanglement for 
the pilot-deployed option. (PDO) 
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■ | ■ o I A. ■ Mike Kelly 

Findings & Observations 

w April 16, 2001 

F-20: Specific tests will be necessary for specific CPAS architectures in 
order to assure a robust, reliable design. 

0-1: In September 2008, the CPAS Subsystem team communicated to 
Project stakeholders an estimate of overall system reliability for a 
pre-PDR CPAS architectural option, without communicating 
attendant uncertainties. Communicating reliability estimates 
without uncertainties can result in decision makers having 
insufficient understanding of reliability risks. 
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■ | ■ o I A ■ Mike Kell 

Findings & Observations 

w April 16, 20 

0-2: The CPAS S&MA team is not utilizing a reliability budget for its 
FTA. A reliability budget includes calculations of quantitative 
component reliability (and uncertainty), rolled up to a total system 
reliability (and uncertainty), with a budgeted reserve that is 
managed like a mass growth allowable, shrinking as the system 
matures. 


0-3: There is expert consensus that pack density over 40 lbm/ft 3 

creates added reliability risks including damage to hardware items 
and soft materials in parachute pack assemblies. This damage 
can lead to parachute inflation malfunctions that cause loads to 
exceed design limit loads, or to components that fail at loads 
below design limit loads. Either of these outcomes can result in 
catastrophic parachute system failures. A pre-PDR design with 
pack density above 40 lbm/ft 3 cannot accommodate likely 
increases in pack density from design growth or vehicle growth 
during development, both of which occurred during Apollo 
development. 
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0-4: The Apollo ELS main parachutes used much of the volume of 

three of its four forward bay sectors (total 75%, minus the volume 
for pilot mortars and uprighting bags). Current CM allocation 
provides for 3 of 6 sectors (total 50%, minus the volume for 
uprighting bags) for CPAS main parachute packs. Drogue mortars 
and other parachute system equipment occupy proportionally 
equivalent percentages of total volume in the forward bays of their 
respective vehicles. It was not possible to ascertain what 
equipment in the CPAS forward bay comprises the difference. 

- Components that may not be related to crew survival should not 
compete for forward bay volume with CPAS components, if their 
inclusion introduces CPAS reliability risks that may adversely 
affect the overall probability of LOC. 
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0-5: Review of Gen 1 test reports suggests that in 2007 and 2008 there 
was a lack of a systematic process in establishing the basis for 
and the conduct of testing. The Apollo Experience Report - Earth 
Landing System (ELS), NASA TN D-7437, (1973), illustrates the 
great extent of the testing that was necessary to demonstrate the 
overall reliability of the ELS system, to make it suitable for manned 
flight. It also illustrated the need for thorough systems integration 
and compatibility verification. Adopting a comprehensive systems 
approach to design, development and testing can deliver a robust, 
reliable system in a cost-efficient manner. 
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0-6: DCLDYN appears to be the Design Team’s principal analysis tool. 
The Project is using its results to support critical design decisions, 
but its veracity and validity are not apparent. Appropriately 
validated parachute analysis tools will be critical to the design of 
CPAS and the verification of requirements. 

0-7: During the period of initial review, it appeared that reliability 
estimation was seen as an appended task instead of a value- 
adding integrated discipline, although interaction appeared to be 
improving in March 2009. 
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0-8: Event trees for any of the CPAS architectures being considered 
include complex networks of events that involve numerous system 
components that interact with each other in different ways during 
different events. Some CPAS components interface with other 
systems that are being developed by other teams in the matrixed 
organization. Pre-PDR system development is an iterative process 
that necessarily needs to involve coordination with the interfaced 
systems. The complexity of communicating across an extended 
matrixed organization can hinder thorough investigation of system 
component interfaces with other systems. During the period of 
initial review, minimal interface control information had been 
generated by the CPAS Subsystem team. 
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0-9: Apollo engineers assessed risks of abrasion, friction damage, 

hang-up objects and sharp edges and addressed each one by 
analysis and testing with full-scale representative mockups. The 
CPAS Gen-1 forward bay full-scale mockup shown in pictures in 
I DR charts lacks significant geometric details for such a series of 
tests. 


0-10: Using a plausible but unverified rationale that damage to Kevlar® 
risers and suspension lines will be minimal if impacted while 
lightly loaded, the CPAS Subsystem team actively discounts the 
risk of damage to critical components of more than one main 
parachute, from Far-Field contact with the FBC. Far-Field 
contact risk increases if auxiliary chutes do not become part of 
the system, or if the auxiliary chute subsystem malfunctions. 
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0-1 1 : The CPAS configurations reviewed make use of multi ayered 
and dissimilar materials, Nylon®, Kevlar®, and Vectran®, in 
joint construction. The behavior and efficiencies of such 
construction must be fully characterized to meet strength and 
mass design goals. Detailed knowledge of parachute joint 
efficiencies for each joint in the assembly is critical for 
successful recovery system design. 


0-12: Information reviewed by the NESC Team did not reveal 

whether material tests that generated distributions used in the 
load/material distribution-intersection reliability estimation 
method, were performed with the same material type to be 
used in the system, whether there was statistically enough data 
in the population, or whether the data population represented 
all expected factors that can degrade the components’ material 
properties. 
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0-13: Reliability risks associated with high packing density can include 
damage to both the hardware items and soft materials in the 
parachute pack assembly. This damage can result in 
weaknesses in the system leading to failures at less than design 
limit loads or parachute inflation malfunctions that can that 
exceed the design limit loads for the system, either of which can 
result in catastrophic failures in the parachute system. 
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0-14: Apollo ELS engineers developed a successful method for 

verifying intact reefing lines prior to flight. A strong monofilament 
witness line (aka ‘catgut’) was carefully measured and routed 
through each reefing cutter during the packing operation. One 
end was left accessible on the outside of the d-bag. Prior to 
parachute installation, the witness line was removed and 
measured. If it was less than the pre-installed length, the pack 
was rejected. The program always packed four chutes for each 
mission, in case one was to fail the catgut test (or other pre-flight 
inspection). The Program ran a comprehensive test and 
qualification program utilizing the catgut procedure. 
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0-15: Strategically located TPS could serve to restrain CPAS packs 
from entering thermal stand-off zones while providing abrasion 
protection during deployment (RAO, LAO). Tests would be 
required to establish if curtains would be a hindrance to FBC 
separation, and to characterize material performance after 
exposure to mission environmental conditions. 

0-16: The SRB Project packs main parachute canopies in their d-bags 
in a circular pattern to mitigate the risk of abrasive damage to 
parachute components during deployment, ref. NASA 
Engineering Network entry 0836. (RAO only) 
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0-17: The stowage routing scheme for the dual-drogue harnesses, on 
the outside of the FBC and covered with TPS, poses a risk 
during reentry of a single event of TPS damage resulting in burn 
damage to two drogue harness legs - one from each drogue 
harness set. 


0-18: Kicker strap concepts that were reviewed used some of the 
aerodynamic force provided by the drogue parachute(s), to 
impart a radial force to each of the three main d-bags collectively 
while they are being extracted, to reduce the risk of near field 
contact of main d-bags with CM tunnel and gussets, but these 
may increase the risk of their near field contact with the FBC. 
Kicker straps may also provide for more synchronous 
deployment and better load sharing under adverse conditions. 
(LAO). 
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0-1 9: Kicker straps that use some of the aerodynamic force provided 
by a pilot parachute to impart a radial force to a main d-bag while 
it is being extracted, may reduce the risk of near field contact of 
main d-bagswith CM tunnel and gussets. (PDO) 

0-20: To ensure a robust and reliable design, the Apollo Program 

proved every part number and every assembly number by test or 
analysis to certify the system for man-rated flight. 
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0-21 : To improve the timeline for pad abort, CPAS changed the PTRS 
in March 2009, to align their requirement for pad abort fault 
tolerance with GNC requirements. The change was from a 
requirement of one failed drogue parachute and one failed main 
parachute, to one failed drogue parachute or one failed main 
parachute. 
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0-22: For pad abort, the requirement for the LAS is to deliver the CM at an 
attitude of less than +/-70 degrees prior to drogue mortar initiation. The 
requirement was established by running Monte Carlo simulations using 
DSS. Insufficient information was reviewed for the NESC team to assess 
this result, but the method is unorthodox. If after a LAS hand-off, one 
drogue fails to fire, the remaining drogue mortar will deploy the 
confluence ring, riser and pack, and 2-5 seconds later the CM will be 
released from the FBC. During those 2-5 seconds, the drogue pack may 
reach line stretch and inflate to its first reefing stage. The drogue will tend 
to pull the CM apex away from the direction of travel, reducing the angle, 
but the drogue’s three-legged harness, which provides CM stability for a 
normal reentry, may not be deployed for sufficient time to positively affect 
CM stability. The requirement at FBC release is +/-50 degrees. The 
attitude and rates of the CM at FBC release will depend on stochastic 
factors that may not be fully modeled in simulations. It may be imprudent 
to conclude that the CM will be within +/-50 degrees attitude at FBC 
release based only on preliminary simulations. FBC release with large 
CM attitudes and rates will increase the risks of all of the following: pilot 
parachute entanglement, failure to extract main packs, Near-Field 
contact of main d-bags, Near-Field contact of main parachute 
components during extraction from d-bags, and Near-Field contact of 
main parachute components during deployment. Any of these increased 
risks increase can result in a failed main parachute. 
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0-23: Several known Apollo Test and Analysis reports with data that 
would be useful to the CPAS S&MA Team for generating 
reliability estimates cannot be located. 
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0-24: The NESC team observes that the following set of architectural options 
comprehensively reflects many of the team’s recommendations. The 
team recognizes that CPAS personnel are managing a complex 
problem, wherein each proposed design feature change affects several 
others, and that there are numerous integration constraints involving 
other Orion subsystems. The NESC team’s comprehensive set of 
options may (or may not) add mass, but may reduce a number of 
reliability risks and provide a positive volume budget for future 
development. 

- Four FBC-deployed pilot parachutes. 

- Four main parachutes. 

• Four parachutes may open faster than three (with comparable drag 
area), which could provide more time on the mains after pad abort. 

• One failed main would result in a residual 75% capability rather than 
66% capability. 

- Four main d-bags that are: 

• smaller 

• less dense 

• less irregularly shaped 

• have a volume reserve 
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0-24: (Continued) 

- D-bags stowed in the four sectors of the forward bay that do not have drogue 
mortars. 

• If the four packs use 90% of each sector (4 of 6 sectors X 90% = 60% of 
forward bay), this allows 10% of each sector for stowage of other items. 

• Using 60% of the forward bay represents a 20% increase in total utilized 
volume (old, 3 of 6 X 100% = 50% of forward bay, and 60/50 = 1.20). 

- Redundant kicker straps on each d-bag to mitigate the risks of geometric lock. 

- A 20% increase in total utilized volume could allow: 

• About 5% decrease in the size of each parachute pack. Main packs that 
are smaller can have simpler shapes, which could reduce risks associated 
with Near-Field contact and rigging errors. Simpler shapes may also allow 
simpler retention systems with more reliable release mechanisms. 

• About 5% decrease in each pack’s density. Main packs that are less dense 
have reduced risks of damage from packing. 

• About 5% volume reserve for future arowth. Main packs with a growth 
allowable can accommodate future development growth. 

• About 5% increase in total parachute mass (if mass increase at all). This 
could allow incorporation of features that resolve parachute structural 
weaknesses. 


This briefing is for status only and does not represent complete engineering data analysis 

NESC Request No: TI-08-00487 


57 


NESC Request No.: 08-00487 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

61 of 156 


Backup - Reference Material Reviewed 


Mike Kelly 


April 16, 2009 


Assessed Reference Material 

1 Requirements 

JSC64355_Assump_Memeo.doc 

J AS63497_CPAS_PT RS. doc 

Deployment Envelope Comparison, ppt 

PTRS Signed Off 01 , 1 6, 09 pdf 

Assumptions Document.doc 

PTRS Requirements Specification 10.17.08.pdf 

CX Pyro specification JSC 62809.pdf 

CxP70135.pdf 

NASA-STD-501 9. pdf 

NASA-STD-6016.pdf 

CxP 70038 pdf 

2 Design 

LAS Well Photo.jpg 

GN&C Design Databook (LAS Abort) pdf 

GN&C Block Diagram, pptx 

CEV Pyro Event Controller Block Diagrams, ppt 

CEV FBC R&R Mechanism - Design Update (2/2/09). ppt 

GN&C design Databook (Entry), pdf 

GN&C Design Databook (iGN&C) pdf 

LAS Fairing Assembly, ppt 

CEV FBC R&R Mechanism (ODAC-3POD).ppt 

Re-entry Sequence DRAFT 01.06.09.xls 


3 Reliability 

CPAS Fault Tree 2-24-09.pdf 
Reliability Data Critical Review 02. 03. 09. ppt 
Preliminary Fault Tree 1 1 .25.08.tif 
Statistics and Reliability Subteam Notes ppt 
CPAS Sys IDR RAESR.doc 
CPAS Sys IDR PRA.tif 

CPAS Sys IDR PRA Reliability Predictions ppt 

CPAS Sys IDR HA 112508.xls 

CPAS Sys IDR FTA.tif 

CPAS Sys IDR FMEA 112508.xls 

CMO GFE Directive CMOG-CPAS 02-15-09 Main 

Configuration, ppt 

Orion Decision Making Process, ppt 

Airborne_OrgLChart. pdf 

CPAS Revised Functional Team Chart.ppt 

ESCG - CPAS Org Chart, ppt 

NASA - CPAS Org Chart, ppt 

CPAS organization charts, ppt 

CPAS Project's schedule, ppt 
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Assessed Reference Material 

4 Testing 

ESCG-4390-08-SP-DOC-0028_BASELINEPDF[1].pdf 
ESCG-4390-08-SP-DOC-0036_PDFBASELINE[1].pdf 
ESCG-4390-08-DOC-0029_Ba seli ne [1 ]. pdf 

5 Meetings 

I DR charts - updated : received 02.02. 09. ppt 

Updated CPAS IDR Charts.ppt 

CPAS System IDR “Final* Presentation. ppt 

CPAS System IDR Preliminary Charts.ppt 

Agenda for IDR ppt 

Pre-Kickoff Charts 12.03.09. ppt 

Twist Testing ppt 

Single Point Attach Reliability , ppt 

Pareto WGA Analysis, ppt 

New Riser Stowage Method, ppt 

Main Deploy Pro Con. doc 

Gussett Fairlead Concept, ppt 

Energy Modulator Analysis ppt 

Agenda 012809.doc 

Pareto WGA Analysis ~ presented by Airborne Systems ppt 
CPAS Mel Summary Post IDR, Rev A 012909.doc 
CPAS Mel Rev A Excel Basis xls 
Kokis’s chart re ERB decision on single point attach. ppt 


5 Meetings (cont) 

SE&I Agenda 020209.doc 

Kelly notes from 020209 SE&I IPT.ppt 

Reliability PRA.ppt 

Reliability Predisctions.xls 

Snyder Notes from SE&I IPT.doc 

Notes from 3.02.2009 SE&I Meeting.doc 

2009.03.02 SEI IPT.ppt 

Snyder Notes from SEI IPT March 16.doc 

JSC64335_Assump_Memo.doc 

PTRS draft proposed revision 03 1 6 09 doc 

Reliability_FT A. ppt 

FT A_Descriptions.doc 

CPAS summary position on main d-bag shape issues 

02.06.09. doc 

Hardware IPT_01.28.09_Nicks's notes. ppt 
Single Point Attach chart from Hardware IPT meeting 

01.21.09. ppt 

Nicks notes from Hardware IPT 02.04.09. ppt 

Load Sharing Assumptions. ppt 

Flight Testing Instrumentation Data RatesTable.xls 

Drogue Load sensitivity to weight increase. ppt 

CPAS Hardware IPT Agenda 02-11-09.doc 

Bob's Notes regarding the Charts from FEB 11 Hardware 

IPT.ppt 
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Assessed Reference Material 

5 Meetings (cont) 

Update To The DSS Inflation Model. ppt 
Drogue Parachute initial Conditions GB.ppt 
Drogue Harness Design Dispersions, ppt 
CPAS avionics requirements.doc 
CPAS avionics capabilities.doc 
20090218 CPAS Hardware IPT Agenda.doc 

03.24.09 S&MS Telecon Definitions document.doc 

03.24.09 S&MA T elecon Charts, ppt 

Jims notes from Jacobs/Airborne reliability telecom 

02.03.09 doc 

02.03.09 Reliability telecom w/Jacobs and Airborne. ppt 
ERB Charts Briefed 03.1 2.09. pptx 
Parachute ERB Briefing 03.02 09. ppt 
ERB Orion-09-0355 - CPAS DAC3 Update. pptx 

6 Historical Information 

Apollo Earth Landing Systems Experience Report by Bob 
West, pdf 

Apollo Deployment Envelopes, ppt 

Apollo 15 Parachute failure.pdf 

Apollo Technical Manual - Reliability pdf 

Apollo Parachute Landing System - Knacke.pdf 

Juan Cruz Parachute Course.pdf 

Reefing Line Cutters tutorial from MH.ppt 


6 Historical Information (cont) 

• Parachute System Arrangement Sketch - Block I .jpg 

• Main Harness Attach Fittings Sketch - Block I .jpg 

• Apollo_17.jpg 

• Apollo_17_Cover_2.jpg 

• Apollo_17_Cover_1 jpg 

• Apollo_16_CM-1 1 3_USSRC_2008_RK_5 jpg 

• Apollo_16_descends_to _splashdown.jpg 

• Apollo_15_with one failed main parachute jpg 

• Apollo_1 5_CM-1 1 2_Dayton_2008_RK_9.jpg 

• Apollo_1 5_CM-1 1 2_Dayton_2008_RK_8.jpg 

• Apollojl 5_CM-1 1 2_Dayton_2008_RK_5.jpg 

• Apollo_14_5.jpg 

• Apollo_14_4.jpg 

• Apollo_14_3.jpg 

• Apollo_14_2 jpg 

• Apollo_13_1.jpg 

• Apollo_8_CMSI_RK_2008_4.jpg 

• Apollo Soyuz Test Program jpg 

• Apollo Soyuz Test Program_2.jpg 

• Apollo Drogue layout in mortar tube jpg 

• Gemini_9_2.jpg 

• Gemini_9_1.jpg 

• Gemini_Model.jpg 
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• Assessed Reference Material 

• 6 Historical Information (cont) • 6 Historical Information (cont) 

• Gemini 11 2.jpg * ParachuteSystemdesignCaseStudy-Huygens.pdf 

• Gemini_11_1 jpg * ParachutePartiallnversions.pdf 

• Gemini_Parachute_System_Sketch.jpg * ParachuteMortarDesign.pdf 

• Parachute Deployment Sequence VIDEO CLIP (MOVIE) mov * Parachute opening Critical Opening Velocity (1 971 ). pdf 

• Main Parachute Deploy Sequence from Movie. ppt • Parachute Definitions, Nomenclature, and Types_Behr and 

• Mercury_MA7_CMSI_RK_2008_5.jpg Lingard.pdf 

• Mercury_MA7_CMSI_RK_2008_4.jpg 

• MLAS FBC 02.jpg 

• MLAS FBC 01 jpg 

• SRB parachute drop test report.tif 

• SRB main parachutes installed. ppt 

• STS-52.vob 

• SRB_Recovery2.jpg 

• SRB_Recovery.jpg 

• SRB_2.jpg 

• SRB_1.jpg 

• SRB_0.jpg 

• SRB Mains Attach Closeup.jpg 

• MLAS Design Review - Sep 2008 pdf 

• Irvin Design Guide.pdf 

• DEPLOYABLE AERODYNAMICS DECELERATION 
SYSTEMS pdf 

• Dynamic Analysis Of SRB Parachute Systems (Wolf, 1991) pdf 

• SRBRecoverySystems.pdf 
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Appendix B.2. Supporting Addendum of Team Assessment for 
Stakeholder Outbrief of Interim Recommendations 1 


This Addendum contains a list of 336 factual statements (FS) and 96 experience-based 
observations (EO) from the NESC team’s first review period (RP-1) which culminated in 
Outbrief 1 in April 2009. 

During RP-1, the CPAS project and its contracted affiliates were working very hard during this 
time, given a complex design integration problem to converge on an architecture that would 
result in a robust and reliable system. Design details and requirements evolved rapidly during 
RP-1. During this dynamic time the assessment team rapidly evaluated a great many design 
details and project work products. 

The NESC parachute subteam members and reliability sub team members were active teaching 
each other pertinent factual aspects of their respective crafts. In an effort to compile and organize 
all of the assessed information in a manner that would facilitate the creation of its first set of 
findings, observations and interim NESC recommendations, the team created the following list 
ofFSandEO. 

The list is reproduced in this Appendix to provide the reader insight into the many team 
discussions that resulted in the first set of findings, observations and interim NESC 
recommendations. Some of the items in this list may appear to be elementary or obvious 
statements of fact. These were deliberately captured as building blocks to aid technical 
understanding across the subteams and to create logical foundations for the team findings, which 
were derived later. 

The list is organized into groups of factual statements and experience -based observations 
according to the following categories: 
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Organizational Communication 

FS-l: Airborne Systems North America (Airborne, aka Irvin Aerospace) is contracted by Jacobs 
Engineering and Science Contract Group (Jacobs ESCG, aka Jacobs), to provide development 
data, design data, test hardware, and test data to the CPAS Project. 

FS-2: The CPAS Project will deliver the Airborne development data, design data, test hardware, 
and test data as Government-Furnished Equipment (GFE), to Lockheed Martin (LM). 

FS-3: The CPAS team members from NASA Johnson Space Center (JSC), Jacobs, and LM are 
located in Texas. Airborne is located in California. 

FS-4: JSC/Department EA3 and Jacobs share primary System Engineering and Integration 
(SE&I) responsibilities for the project. JSC/Department EA2 has adjunct SE&I responsibilities. 
Airborne also has a System Engineering Lead. 

FS-5: A chart presented at the December 2008 Initial Design Review (IDR) identified an 
individual as the “Project Engineer/SE&I IPT Lead” (Integrated Product Team Lead) for 
Airborne. 

FS-6: Jacobs has primary Safety and Mission Assurance (S&MA) responsibilities for the project 
and JSC/Department NT has adjunct S&MA responsibility. 

FS-7: Airborne provides reliability estimates for parachute structures to Jacobs for use in S&MA 
Fault Tree Analysis (FTA). 

FS-8: LM and NASA coordinate program decisions via a Technical Integration Team (TIT). 

FS-9: The inclusion of Airborne in the functional organization adds organizational complexity by 
creating an extended, matrixed organization that is also geographically dispersed. 

FS-10: The CPAS functional organization is complex. 

FS-l 1: Organization charts show the Analysis Team to be connected to the project by dotted 
lines. 

EO- 1 : Dotted lines on organization charts can suggest limited oversight. 

FS-l 2: Organization charts show that LM and NASA have sufficient review boards and panels 
for assessment of CPAS Project decisions. 

FS-l 3: From December 2008 through March 2009, S&MA fault trees and reliability estimates 
lagged behind in their representation of the evolving baseline design architecture. 

EO-2: Inherent difficulties with communication across a complex, extended, matrixed 
organization may have contributed to S&MA fault trees and reliability work products that lagged 
behind design decisions between December 2008 and March 2009. 
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EO-3: Prior to the December 2008 IDR, preliminary reliability estimates were communicated to 
Constellation Program (CxP) decision makers, apparently without caution or explanation about 
the limitations of their foundation. 

EO-4: From December 2008 through February 2009, it appeared that the reliability assessment 
was seen as a separate task instead of an integrated discipline that improves design decisions. 

EO-5: In March 2009, it appeared that coordination between the S&MA Team and the Design 
team was improving. 

FS-14: Operation of CPAS will involve a complex network of events, some serial and some in 
parallel, that involve numerous system components that must interact with each other different 
ways during different events. These interactions will vary by choice of architecture. 

FS-15: CPAS components will interface with other systems; these interfaces will vary by choice 
of architecture. 

FS-16: Systems with which CPAS interfaces are being designed by teams in various places in the 
matrixed organization. 

EO-6: CPAS architectural design definition would be expected to be iterative during the time 
leading up to PDR. 

FS-17: Minimal interface control documentation was provided for review between December 
2008 and March 2009. 

EO-7: The complexity of communicating across an extended matrixed organization can hinder 
thorough investigation of system component interfaces with other systems, which may lead to 
poor design decisions. 

FS-18: PTRS and reviewed documents make no mention of using NASA SP-2007-6105, NASA 
Systems Engineering Handbook or NPR 7 123.1 A, NASA Systems Engineering Processes and 
Requirements. 

Fault Tree Analyses, Reliability Estimates, Uncertainty, and 
Reliability Budgets 

EO-8: FTA is a well-established methodology that uses Boolean logic to reduce the Fault Tree 
structure into the combinations of events (Minimal Cut Sets) leading to failure of a system. 
Probabilities are computed for individual Minimal Cut Sets, forming the basis for their ranking 
by importance with respect to their reliability and safety impact. FTA is especially useful when 
analyzing large and complex systems where manual methods of fault isolation and analysis are 
not viable. 
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EO-9: FTA top level events must be described precisely. 

• Defining a top event too broadly leads to an open-ended tree, showing no specific cause 
or causes for failure. 

• Defining a top event too narrowly leads to possible cause omissions. 

EO-IO: An FTA needs to include all possible weaknesses, faults or failures present in the system 
that could cause safety hazards or reliability problems. Hardware, software, and human 
components of the system must be included in the FTA. All interactions between the system 
components and elements must be fully described in the FTA. 

FS-19: IDR presentation stated that the FMECA, PRA and FTA are three independent 
deliverable requirements for the CPAS program. 

• Preliminary results of FTA and PRA were presented in IDR. 

• FMECA results were not presented at IDR. 

FS-20: The methodology being employed by the CPAS S&MA Team in March 2009 showed 
exclusive emphasis on the top-down/functional FTA. Consequentially, the Fault Tree is 
repetitive and lacks specificity at places (e.g., the near identical chute reefing failure modes were 
repeated seven times for Drogue, Main and Auxiliary chutes). 

EO-11: The arrangement between Airborne and Jacobs for performing various reliability 
analyses and other design assurance functions appears to violate the fundamental reliability 
principle that reliability is a part of the design process. It has to be built in at the beginning to be 
most effective and it has to be a real time, interactive and iterative process. 

EO-12: It appears that the various Project reliability analyses are being used principally as 
documentation/verification function after-the-fact, rather than as a design tool to continuously 
assess and improve the system reliability. The S&MA approach appears to be seeking a static 
design, which is inconsistent with the level of maturity in the design process with ongoing 
configuration changes. 

EO-13: The current format and functional nature of the FTA makes it difficult to correlate the 
failure modes to the specific hardware. This makes it difficult to identify where additional 
analysis and/or testing could be strategically employed to reduce uncertainty in the reliability 
estimates. 

FS-21: Although FTA is a tool to detect the potential system weakness in a complex system, the 
FMECA (“bottom-up” approach) could be a better tool to qualitatively analyze and scrutinize the 
CPAS component design. 

FS-22: S&MA is maintaining two fault trees, a simple tree with narrative definitions to specify 
the precise failures included in each box, and a more detailed tree with sub-trees. 
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EO-14: Some events in the CPAS deployment sequence will be dependent on other events, some 
will be independent. The reliability of CPAS will be dependent on the probability of the 
successful outcome of each event. The probability of the successful outcome of each event will 
be dependent on the reliability of the system components that participate during each event. 
Ultimately, design component reliability will drive system reliability. 

EO-15: The detailed FTA that can trace failures down to component level is the more valuable 
version of the two S&MA FTAs. 

EO-16: The shortened ‘PowerPoint’ version of the FTA with a definitions page attached, has 
limited utility except for a communication tool, and it presents risks of miscommunication. 

EO-17: Reliability estimates change and evolve as systems are developed. 

FS-23: Fockheed is maintaining a fault tree with integrated risks that include CPAS failures, 
with the intention to plug in the CPAS tree to the Fockheed tree after CPAS PDR. 

FS-24: S&MA has placeholders for integrated failures that relate to systems outside of the CPAS 
system, including CEV systems. 

FS-25: The project S&MA Team FTA starts with undesired events (failures) and builds from the 
top, down. The S&MA Team plans to develop the PRA data by testing. 

EO-18: The Fockheed FTA was reported in a March 2009 teleconference to start with 
component data and build from the bottom, up. 

EO-19: There is value in doing FMEA in addition to PRA. 

• PRA process using FTA is a deductive (top down) method useful for analyzing failures 

• FMEA is an inductive (bottom up) method 

• FTA and FMEA complement each other. FTA could be qualitative or quantitative 
whereas FMEA is qualitative 

• Note: FMECA could be qualitative or quantitative. Mostly NASA does FMEA with an 
exception of JPF which does FMECA 

FS-26: The S&MA fault tree refers to main parachutes A, B, C, which are stowed in sectors 
identified by Fockheed as B, C, and E, respectively. 

FS-27: Between December 2008 and March 2009, the project has occasionally discussed 
relocating parachutes to other stowage sectors. 

EO-20: Asymmetry of main parachute stowage could lead to special risks for individual 
parachutes. For example, side-by side mains stowed in sectors B and C might be more likely to 
pose risk to each other during deployment (entanglement, contact, etc) than they do to the main 
stowed in sector E. Or, the energy modulators attached to the same FBC beam (above Gusset 
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120, between sectors B and C), may interfere with each other, posing reliability risks not present 
with the d-bag in sector E. 

FS-28: The CPAS reliability estimate of 1:217 for more than one main parachute contacting 
CEV structure during deployment was communicated by S&MA analysts without an estimated 
or calculated uncertainty or a statement regarding the applicability of SRB data. An estimated 
value for uncertainty for this risk would have been large, owing to the geometric inapplicability 
of the SRB data to the CEV system. 

EO-21: Communicating reliability estimates without quantitative uncertainties or qualitative 
uncertainties (e.g., reference system similarity), for the purpose of comparing competing 
architecture alternatives, can lead to poor design decisions. 

EO-22: Communicating inapplicable reliability estimates can result in poor design decisions that 
can adversely affect system reliability. 

FS-29: The CPAS reliability estimate of 1:217 for more than one main parachute contacting 
CEV structure during deployment was communicated by S&MA analysts without an estimated 
or calculated uncertainty, through the NASA and Lockheed chains of authority. 

FS-30: A Lockheed Engineering Review Board (ERB) assessed that the CPAS system was 
driving the overall reliability for Orion, by including the CPAS reliability estimate of 1:217 for 
more than one main parachute contacting CEV structure during deployment. 

FS-31: The JSC Director of Engineering asked for this NESC team to conduct an assessment of 
CPAS reliability estimates (among other objectives), citing the Lockheed ERB finding that the 
CPAS reliability estimate of 1:217 for more than one main parachute contacting CEV structure 
during deployment was driving overall Orion reliability. 

FS-32: Reliability estimates for drogue and main parachute structural component failures were 
created by Airborne. 

FS-33: Some reliability estimates presented at the IDR in December 2008, were said to have 
been based on Army, Apollo, Soyuz, and Space Transportation System (STS) SRB data, but that 
document did not include the lineage and derivation of each estimate. 

FS-34: Reliability estimates for drogue and main parachute structural components that were 
presented at the IDR in December 2008, were said to have come from drop test data, vendor 
component data, and prediction. Fifteen out of twenty-three estimates were said to have been “by 
prediction.” 

FS-35: Some predicted reliability estimates that were presented at the IDR in December 2008 
were computed using a reliability estimation method, wherein a pertinent material strength 
distribution would be compared to an applied loads distribution. The unreliability of the 
component is calculated from the area of intersection of these two distributions. 
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EO-23: The reliability estimates that were computed by Airborne using the distribution- 
intersection estimation method may underestimate the risk of failure of those components. 

FS-36: The CPAS Project has not proposed the development of test plans to show how reliability 
estimates based on prediction would be verified/validated. 

EO-24: Some reliability estimates were based on results from simulation codes for which it was 
not clear if rigorous V&V had been accomplished. 

FS-37: Reliability estimates for drogue and main parachute structural components that were 
presented at the IDR in December 2008, included five items with failure rates of 1:10,000 or 
worse. Three of these were determined by test and two were estimated by prediction. 

Determined by test: 

• Failure of a drogue parachute with a root cause in some aspect of the packing 

( 1 : 10 , 000 ) 

• Failure of a main parachute with a root cause in some aspect of the packing 

( 1 : 10 , 000 ) 

• Failure of a drogue parachute with a proximal cause in some aspect of the parachute 
failing to extract from the d-bag (1:3,333) 

Estimated by prediction: 

• Failure of a main parachute with a proximate cause of failure of an unspecified 
number of attachment joints between skirt structural elements and suspension lines. 
(1:806) 

• Failure of a main parachute with a proximate cause of failure of an unspecified 
number of vent line attachments. (1:8446) 
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FS-38: The following table of failure mode estimates was received from the S&MA team on 
March 3, 2009. 


Failure Mode 

Estimate 

(1/x) 

Prediction 

(1/x) 

Rationale 

Main / Drogue Confluence Failure 

>10M 

- 

Low number due to proof testing and subsequent 
post packing X-ray inspections. 

Environment Induced Failure 

>10M 


Low chemical concentrations not expected to affect 
parachutes. Vibration could change the shape of 
bags causing contact issue. Low number due to 
vibration qualification. 

Rigging Error (Main + Drogue) 

100,000 

- 

Conservative number due to decreased complexity 
compared to parachute packing. 

Far-Field Contact 

70,000 

- 

Failure due to 2 auxiliary failures. 

Near-Field Contact 

15,696 


From SRB data for 3 contact chute failures. 
Nominal case assumed for independent events due 
to testing activities. 

Main Chute Entanglement 

1,000,000 

- 

Estimated 2/3 rds of a twist from 2-3 seconds for 
deployment supports low number. 

Drogue / Auxiliary Entanglement 

1,000,000 

- 

Low number due to minimum twist due to fast 
deployment. 

Skipped Reefing Stage Failure 

200,000 


Low number due to remote chance of packing 
error, broken reefing line or X-ray test escape from 
high packing density. 

Chute Deployment Failure 

- 

2.00E+04 

Flistorical Data (lower bound) dominated by 
parachute packing. 

Lead Lag Failure 

>10M 


Low number due to treatment as structural failure. 

Inflation Failure 

1,000,000 

- 

Given successful deployment and vehicle stability, 
inflation failures historically have been non-issues. 

Reefing Cutter Fails to Disreef 


4.00E+04 

With redundancy (0.995 ea). 


EO-25: The project has broadly assessed that chemical concentrations will be low, and so the 
risk to the parachutes will be low, but the allowable chemical concentration would depend on the 
specific chemical compound. 

FS-39: The project recognizes the risk of vibration changing the shape of d-bags and causing 
contact with the FBC IMF, and expects to mitigate the risk by vibration qualification testing. 

FS-40: The project has estimated that the probability of a single parachute contacting CEV or 
FBC structure is 1:15,696. This is a revised number from the 1:8,205 presented at the 
December 2008 IDR. 
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FS-41 : The project estimates that the CM can roll 240 degrees (“2/3 lds of a twist”) relative to the 
drogue-suspended FBC, during the estimated 2-3 seconds between FBC release and line stretch, 
and uses this to support an estimate of Main Chute Entanglement of 1:1,000,000. 

FS-42: The project estimates that the risk of drogue chutes or auxiliary chutes entangling with 
themselves or which each other during deployment is low, because they are deployed and 
inflated fast. 

FS-42b: Theo Knacke report states “Wind tunnel tests and free fall tests of a full-scale 
dynamically-similar CM indicated instability in all 3 axis. A preferred short-duration attitude of 
the CM was nose down at about 135 degrees to the take off (zero degree) attitude” 

FS-43: The project estimates the risk of skipped reefing stage at 1:200,000, in part because of a 
“remote” chance of failing to detect a damaged reeling ring or prematurely triggered cutter using 
X-ray non destructive evaluation, even at high-packed densities. 

F-44: The project lower-bounds the probability of chute deployment failure at 1:20,000 based on 
historical data. Packing errors are said to be predominantly responsible for deployment failures. 

FS-45: Lead/lag failures, the risk of one main parachute beating its cluster mates to the moment 
of line stretch and inflation so much earlier that it’s loads exceed margins and it fails, is said to 
be treated as a structural failure, so the probability is set arbitrarily low in this table. 

EO-26: The condition of lead/lag could be a design loads driver that could affect both the CM 
and the parachute. It would not be the results of a failure or an out of spec condition. 

EO-27: The probability of a lead/lag deployment event was high for Apollo Block II ELS main 
parachutes, because they were mortar deployed in different directions. The probability of a 
lead/lag deployment event may be less for CPAS than for Apollo, for all three architectural main 
deployment options, because all three main parachutes are deployed in the same direction. 

EO-28: The project has assessed inflation failure to be a low risk, with a stable vehicle, but 
stability is not assured during deployment. 

FS-46: The project has predicted that two reefing cutters have a combined reliability to cut a 
reefing line of 0.995. 

Applicability of Apollo Geometry for CPAS Near-Field Contact 
Estimates 

FS-47: Parachute systems in use for aircraft deceleration or aircraft recovery are deployed from 
stowage spaces that are not geometric similar to the CPAS forward bay. 

FS-48: Parachute systems in use for weapons systems are deployed from stowage spaces that are 
not geometric similar to the CPAS forward bay. 


NESC Request No.: 08-00487 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

75 of 156 


FS-49: The Apollo CM forward bay had four gussets, equally spaced around the Docking Tunnel 
which provided four bays. The three main parachute packs were stowed in three of the bays 
along with its related pilot parachute mortar assembly. The fourth bay contained the drogue 
parachute mortars and the parachute attach/disconnect fitting. The CEV forward bay is 
geometrically analogous to the Apollo forward bay in general arrangement, but is divided into 
six individual sectors rather than four. 

FS-50: Each Apollo main d-bag was lifted from its stowed sector by a force provided by an 
inflated pilot parachute. 

EO-29: If deployed in a nominal vehicle attitude, each Apollo main d-bag was extracted from its 
stowage sector by its inflated pilot parachute in a direction up and slightly away from the 
docking tunnel wall. The initial velocity vector for main chute extraction was dependant on the 
attitude of the CM and its relationship with the associated pilot chute when the pilot chute load 
was applied. 

FS-51: For the loosely-attached-pilot-deployed mains architecture option, each CPAS main 
d-bag will be lifted from its stowed sector by a force provided by a pilot parachute. 

EO-30: For the loosely-attached-pilot-deployed mains architecture option, each CPAS main 
d-bag will be lifted by its inflated pilot parachute in a direction parallel to the tunnel wall. 

Applicability of SRB Data for CPAS Near-Field Contact Estimates 

FS-52: At the December 2008 IDR, the probability of occurrence of more than one main 
parachute contacting CM structure during deployment, while being lifted in their d-bags from 
their stowed locations (for the architecture configuration with main d-bags loosely- attached to 
the FBC underside with two bag handles each, with integrated energy modulators), was 
presented as 1:217. This estimate was shown to have been derived from Space Transportation 
System (STS) Solid Rocket Booster (SRB) data that showed 3 occurrences out of 65 1 
opportunities, of a single SRB parachute failing from contacting the Main Parachute Support 
System (in its frustum) or the frustum edge. 

FS-53: The probability of a single SRB parachute component being damaged by contact (drag 
across, slide along or strike against) the Main Parachute Support System (in its frustum) or the 
frustum edge, reduced over time due to mitigating actions taken by the SRB project. The 65 1 
opportunities that were considered to calculate the 1:217 value is not a true representation of one 
specific configuration, nor any configuration that suitably represents CEV. 

FS-54: The CPAS FBC is analogous in function to the SRB frustum, but differs geometrically in 
significant ways. 

FS-55: The CPAS FBC has six radial beam structures on its underside. These are not large 
enough to extend down between stowed main parachutes. 
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FS-56: The SRB frustum has three deep isogrid panels and three bipod struts on its underside. 
This assembly, known as the SRB Main Parachute Support Structure, separates the three stowed 
main parachute d-bags from each other. 

FS-57: For all three principal CPAS main parachute deployment architectural configurations, 
CPAS main parachute d-bags are lifted from their stowed positions to begin the deployment of 
their packed contents from the bottom. There is no comparable “lifting” event for SRB 
deployment. SRB main parachutes deploy directly from d-bags that are rigidly attached inside 
the frustum. 

FS-58: For all three principal CPAS main parachute deployment architectural configurations, any 
CPAS main parachute d-bag may physically contact (drag across, slide along or strike against) 
the CEV tunnel, up to two CEV gussets, and up to two LAS Wells. This risk only exists for a 
short time while a d-bag is being lifted from its stowed location, until it has cleared the top of the 
tunnel. The top surface of the SRB rocket has no structures analogous to the CEV tunnel, gusset 
or LAS Well. 

FS-59: For all three principal CPAS main parachute deployment architectural configurations, as 
a main parachute’s riser begins to play out of its d-bag, it can physically contact (drag across, 
slide along or strike against) the CEV tunnel, a CEV gusset, or a LAS Well. The top surface of 
the SRB rocket has no structures analogous to the CEV tunnel, gusset or LAS Well. 

FS-60: The SRB reliability data of 1:217 is not applicable to the risk for CPAS of main 
parachute d-bags contacting the CEV tunnel, gussets or LAS Wells during extraction from their 
stowed position. 

FS-61: The SRB reliability data of 1:217 is not applicable to the risk for CPAS of main 
parachute risers contacting the CEV tunnel, gussets or LAS Wells during deployment from their 
d-bags. 

FS-62: The SRB reliability data of 1:217 is not applicable to the risk for CPAS of main 
parachute components contacting the underside of the FBC, in the “loosely attached” main 
parachute deployment architectural configuration. 

FS-63: The SRB reliability data of 1:217 is not applicable to the risk for CPAS of main 
parachute components contacting the underside of the FBC, in the “pilot chutes loosely attached” 
main parachute deployment architectural configuration. 

FS-64: The SRB reliability data of 1:217 is somewhat applicable to the risk for CPAS of main 
parachute components contacting the underside of the FBC, only in the “rigidly attached” main 
parachute deployment architectural configuration. 

• This applicability may be limited by consideration of differences between the Orion 
CM’s dynamic behavior relative to the FBC after separation, compared to the STS 
Shuttle SRB’s dynamic behavior relative to its frustum after separation. 


NESC Request No.: 08-00487 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

77 of 156 


Main Parachute Deployment Bags and Packing Issues 

FS-65: The main deployment bags (d-bags) have an irregular shape, with concavities and sharp 
comers, which could be a factor in packing the parachutes at high densities without inflicting 
damage. 

FS-66: The main d-bags closure flaps are on the bottom, facing the deck when stowed, which 
could have an effect on parachute packing since they will be packed into a sloping surface. 

FS-67: The shape of the main d-bag poses risks of non-homogeneous density and difficulty in 
achieving consistent results from pack to pack. 

FS-68: It may be necessary to imbed stiffeners in the main d-bags to help them maintain their 
shape. 

FS-69: In March 2009, the project discussed an optional pack shape that replaced the concavity 
feature with a faceted comer. This was being coordinated with Lockheed who would have to 
redesign the shape of the LAS Wells to accommodate it. 

FS-70: The system requirement is 38 lb/ft' maximum pack density for the main parachute pack 
assembly. 

• [ISC64335, 1.CM.CPAS.101] - The CM will provide volume to ensure CPAS main 
parachute packing density is less than or equal to 609 kg/m 3 (38 lbm/ft 3 ). Rationale: 

This general requirement requires CPAS to fit within the volume defined by the forward 
bulkhead and FBC. The volume provided by CM will not require packing the mains to 
the density of more than 609 kg/m 3 (38 lb/ft 3 ). 

FS-71: The projected pack density for the main parachute is in the high 40 pounds per cubic ft 
range, for all architectural options under consideration. 

EO-31: There is expert consensus that pack density over 40 lb/ft creates added reliability risks. 

FS-72: Reliability risks associated with high packing density can include damage to both the 
hardware items and the soft materials in the parachute pack assembly. This damage can result in 
weaknesses in the system leading to failures at less than design limit loads or parachute inflation 
malfunctions that can that exceed the design limit loads for the system, either of which can result 
in catastrophic failures in the parachute system. These risks include: 

• A bent reefing ring than can cut a reefing line and result in a skipped reefing stage 

• A bent reefing ring than can damage and weaken a reefing line and result in premature 
disreefing 

• A bent reefing ring than can damage other textile material packed adjacent to it, and 
result in suboptimal canopy performance 
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• A damaged reefing line cutter that cuts a reefing line, and results in a skipped reefing 
stage 

• Two damaged reefing line cutters on one reefing line that cannot actuate, and prevents 
disreefing of that stage (or any subsequent stage) 

• Damaged textiles during extraction from their d-bag, due to heat from friction 

• Reduced probability of detection (POD) of X-ray inspection for damaged pack contents 

FS-73: According to the Apollo ELS Experience Report, during development of the Apollo 
Block II ELS, as the density of the parachute packs increased, the amount of damage to the 
parachutes increased. 

EO-32: Pack density in the high 40 pounds per cubic ft at this stage of the system development 
program leaves no room for error, design growth or vehicle growth (with associated parachute 
growth), all which occurred during Apollo. 

EO-33: Allowing for a 451b/ft 3 density at this stage of the design could paint the designers into a 
comer. It appears a challenge for CPAS to achieve the reliability necessary for a manned system 
with the volume currently provide for three main parachutes, below the required pack density. 

FS-74: Apollo ELS engineers developed a successful method for verification of intact reefing 
lines prior to flight. A strong monofilament witness line (aka ‘catgut’) was carefully measured 
and routed through each reefing cutter during the packing operation. One end was left accessible 
on the outside of the d-bag. Prior to parachute installation the witness line was removed and 
measured. If it was less than the pre-installed length, the pack was rejected. The program always 
packed four chutes for each mission, in case one was to fail the catgut test (or swell inspection, 
stitch inspection or other pre-flight inspection). The method proved to be successful. Apollo ran 
a comprehensive test and qualification program for the catgut procedure, because of their 
recognition that loss of more than one main chute would result in LOC. 

FS-75: Apollo ELS reliability was highly dependent on quality inspection and the skill and 
experience of the inspectors. The skill levels and the procedures were developed and proven 
during the ELS development and qualification program and imposed through the operational 
program. Procedure developers, who had helped develop the inspection techniques, later 
performed operational inspections. 

FS-76: The NASA Engineering network, lessons learned database, entry 0836, submitted in 
1994, documents that to mitigate observed abrasive damage to SRB main parachute canopies 
during deployment, the SRB parachute packing procedure was revised from a “zigzag” pattern to 
a “circular” pattern. 
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Pack Retention 

FS-77: For the loosely-attached mains architectural option, The Main Parachute retention system 
is comprised of two donut ties and two electrically initiated cutters, either one of which can cut 
both ties. The two cords retain the packed main parachutes on its upper surface at six points. The 
six points are ends of six retention straps whose other ends are attached to the CM structure at 
locations beneath the pack and behind it on the tunnel. The retention scheme does not appear to 
allow for growth due to handling, thermal and humidity cycles. A failure at one of the retention 
points will result in the loss of 50 percent of the overall retention capability. The release of the 
retention system is based upon actively initiating two electrically initiated cutters. The failure to 
release the retention system will result in locking a packed main parachute into its stowage 
sector, consequently resulting in failure to deploy one main parachute. 

FS-78: The Apollo retention system was a quick release system that fully covered the packed 
main parachute, retaining it every couple of inches along the perimeter. 

FS-79: For the pilot-deployed mains architectural option, the project redesigned the retention 
release concept to eliminate the electrically initiated cord cutters, and replaced them with a pair 
of redundant cut-knives. 

Volume Budget 

FS-80: Apollo Block II ELS main parachutes were nominally 83.5 ft diameter inflated, compared 
to 1 16 ft for CPAS main chutes. Dimensions are approximately in proportion for vehicle size. 

FS-81: Apollo Block II ELS main suspension lines were nominally 120 ft long, compared to 133 
ft for CPAS main suspension lines. Dimensions are approximately in proportion for vehicle size. 

FS-82: Apollo Block II ELS main risers were nominally 7.8 ft long (6.5 ft steel and 1.3 ft fabric), 
with 3.5 ft fabric bridle legs. This compares to 1 13 ft for CPAS main risers (97 ft suspension 
lines plus 16 ft harness length). The total trailing distance of the Apollo main chute skirt behind 
the C/M is approximately 131 feet versus the 113 feet for the CPAS. This can have an effect on 
both the inflation characteristics and the stability of the inflated canopies. 

FS-83: Apollo ELS Block II devoted 75% of forward bay volume to its three main packed d-bags 
(including most of the riser lengths) and the three pilot parachute mortars for deploying the 
mains. 

FS-84: Apollo ELS Block II devoted 25% of forward bay for its two drogue mortars, its single- 
point attach fixture (also known as the ‘flower pot’), and other hardware not related to ELS. 

EO-34: An estimated allocation of forward bay volume for Apollo Block II ELS components 
other than d-bags is 5% (of total) for each of two mortars, and 5% (of total) for flower pot fitting. 
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FS-85: If the “5% for each mortar and 5% for flower pot” estimate is accurate, then the Apollo 
vehicle used approximately (75 + 5 + 5 + 5 = ) 90% of total available volume of forward bay for 
the Block II ELS, and 10% of available volume for other hardware not directly associated with 
the ELS. 

FS-86: All of the Orion CPAS architectural options under consideration between December 2008 
and March 2009 devoted 50% of the forward bay volume (sectors B, C and E) for the three main 
packed d-bags (including much of the riser lengths but excluding components in the stowage 
container). None of the architectural options under consideration had pilot parachute mortars for 
deploying the mains. 

FS-87: All of the CPAS architectural options under consideration between December 2008 and 
March 2009 used a portion of two sectors for two drogue mortars (one each, in sectors A and F). 

EO-35: An estimated allocation of forward bay volume for each of two CPAS mortars for CEV, 
is 10% (of total), regardless of CPAS architectural option. 

FS-88: The hamessed-mains CPAS architectural option uses a portion of Sector D, for a stowage 
container for one confluence fitting, one rotation torque limiter, excess lengths of three main 
risers, and for the three main harness legs. 

EO-36: For the hamessed-mains CPAS architectural option, an estimated allocation of forward 
bay volume for the CPAS stowage container and its contents is 5 percent (of total). 

EO-37: The single -point-attach CPAS architectural option may require one or more small storage 
containers for excess lengths of the three main risers and for one rotation torque limiter. Risers 
will be longer in this option to account for lost length of harness legs. 

EO-38: An estimated allocation of forward bay volume for the CPAS stowage container and its 
contents is 5% of total, for the single -point attached mains architectural option 

FS-89: Orion CEV uses approximately (100 - 50 - 20 - 10 = ) 20 percent of available volume 
for other hardware not directly associated with CPAS and approximately 80 percent of available 
volume for CPAS. 

EO-39: Compared to Apollo in terms of percent of available volume in the forward bay, 
assuming scalability, Orion is using approximately twice as much volume for items not 
associated with its parachute recovery system. The parachute recover system is a critical system 
for crew survival. 

FS-90: All of the CPAS architectural options apportion components among 4 sectors, B, C, D, 
and E. 

FS-91: CPAS Project charts indicate previous discussion of moving main d-bags from current 
bays (B, C, and E) to three other bays, suggesting some decisional control remains with respect 
to the Lockheed CEV forward bay arrangement. 
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FS-92: Concern with “geometric lock” during extraction (d-bag physical contact with tunnel, 
gussets, and LAS Wells that is so significant as to prevent extraction) is cited in project charts as 
the principal reason to not consider alternative bays for main d-bag stowage. 

EO-40: Relocating main d-bags to other sectors is likely constrained by design decisions made 
by the Orion CEV project that are unrelated to CPAS, but these were not included in the material 
reviewed by the NESC team. 

FS-94: The size of the CPAS main parachutes is principally driven by pad abort loads and 
vehicle weight. The volume of the packed main parachutes d-bags is dependent the size of the 
parachute and the density to which it is packed. 

FS-95: Throughout the development of Apollo, changes being made to vehicle systems and 
structures required continuous improvement in volumetric efficiency of the ELS main parachute 
packs. Demands increased but available volume did not. 

EO-41: Unknown issues during ongoing development of the CPAS system may result in 
increases in the main parachute volume needs. 

FS-96: Unknown issues during ongoing development of the CEV by Lockheed may adversely 
affect the volume available 

FS-97: In the single point attach architectural option, stowage of excess main risers in Sector D, 
with attachment on the 0° gusset, poses riser routing challenges that may affect the reliability of 
deployment. 

Forward Bay Cover 

FS-98: The NASA Engineering Network, Lessons-Learned database, entry number 0836 
submitted in 1994, indicated that abrasive damage was observed to have occurred to SRB main 
parachute canopies during deployment, from contact with the frustum and MPSS. Early in the 
STS program, TPS material was installed around the perimeter on the underside of the SRB 
frustums, to fill the volumes between the two lowest frustum ring frames, to provide a smooth 
contact surface should the main chutes contact the frustum during deployment. Later, this TPS 
material was replaced with a fabric curtain, to perform the same function. Foam material was 
also added to the MPSS bipod struts, to prevent damage from parachute components contacting 
the MPSS during deployment. 

EO-42: Apollo engineers assessed risks of abrasion, friction damage, hang-up objects and sharp 
edges and addressed each one by proving it did not exist or by incorporating abrasion protection. 

EO-43: Parachute components that are deployed from a d-bag that is rigidly attached inside a 
FBC can contact the sides of the FBC during deployment, and this contact can be exasperated by 
the dynamic behavior of the two bodies during separation. 
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FS-99: Standoff distance and/or insulation is required between FBC and the various parachute 
system components in the forward compartment to protect against damage due to thermal 
environment during reentry. 

FS-100: Standoff distance is required between LAS Wells and main d-bags to protect against 
damage due to thermal environment during reentry. 

FS-101: Intentionally blank. Superseded by revision to F-99. 

FS-102: Main d-bag restraint system is complex, due to complex main d-bag volumetric shape. 

FS-103: Vibration during launch or other dynamic events that occur prior to or during reentry 
can cause stowed d-bag surfaces to enter the stand-off volume and remain there for reentry, if 
restraint systems are insufficient. This poses risk of damage to the d-bag and its contents 
(canopy, suspension lines, risers) due to thermal environment during reentry. 

FS-104: Vibration during launch or other dynamic events that occur prior to or during reentry 
can cause stowed and restrained risers and harness legs to enter the stand-off volume and remain 
there for reentry, if the main d-bags have moved. 

FS-105: Commercially available polyimide foam has insulation qualities, mechanical and 
thermal performance and is light weight. These make polyimide foams candidate materials for 
installation between FBC and main d-bags, to act as TPS and as supplemental restraint. 

FS-106: Commercially available polyimide foam has insulation qualities, mechanical and 
thermal performance and is light weight. These make polyimide foams candidate materials for 
installation between LAS Well and main d-bags, to act as TPS and supplemental restraint. 

FS-107: Aluminized fiberglass sleeves have insulation qualities and light weight that make it 
candidate TPS material for protection of textile risers and harness legs that are stowed beneath 
the FBC that may become at risk of damage due to thermal environment near the FBC IML 
during reentry, if d-bags have shifted. 

FS-108: The Ares I-X flight test project wrapped aluminized fiberglass around first stage risers 
and riser attach spools to protect them from expected thermal environments associated with its 
skirt extension / forward skirt separation event. 

EO-44: Curtains installed for protection of d-bags against physical damage could become a 
hindrance to d-bag extraction unless it is securely attached to the FBC, and therefore removed 
from the forward bay at FBC release. 

EO-45: TPS installed for protection of d-bags against thermal damage could become a hindrance 
to d-bag extraction unless it is securely attached to the FBC, and therefore removed from the 
forward bay at FBC release. 
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FS- 109: A review of CPAS preliminary design details reveal a risk of heat damage to main 
parachute risers from high temperatures at the FBC IML during reentry - if the bottom ends of 
the risers are stowed on CEV gussets in close proximity to the FBC IML. 

FS- 1 10: A review of CPAS preliminary design details reveal a risk of heat damage to main 
parachute risers from high temperatures transmitted from the LAS wells during reentry - if the 
bottom ends of the risers are stowed on CEV gussets in close proximity to the LAS wells. 

Drogue Deploy Envelope 

FS-lll: CPAS drogue deploy envelope was developed using Monte Carlo simulations. 

FS-1 12: The drogue deploy envelope is comprised of overlapping zones for pad abort, ascent 
abort, and nominal reentry. 

FS-1 13: The drogue deploy envelope Points 4 and 5 were relocated in March 2009. Point 4 was 
moved from 53,000 ft at 99 psf to 45,000 ft at 150 psf. Point 5 was moved from 32,000 ft at 
167 psf to 32,000 ft at 150 psf. 

FS-1 14: The drogue deploy envelope zones are dissimilar from those for the Apollo drogue 
deploy envelope. 

EO-46: The drogue deploy envelope establishes candidate flight test data points. 

Drogue and Main Parachute Construction and Failure Risks 

FS-1 15: The CPAS drogue parachutes are variable porosity conical ribbon chutes. The Drogue 
Parachute Drag Surface incorporates “Rip-Stops” to preclude tear propagation. 

FS-1 16: The CPAS drogue canopies are nominally 23 ft diameter. According to Project analysts, 
the CPAS drogue size is driven by high altitude aborts, with high q and high weight. 

EO-46b: Drogue size may be driven by CM stabilization and deceleration requirements 
throughout the recovery system operating envelope. The rate of descent on the drogues will vary 
depending on the altitude. The basic requirement is to stabilize the CM and bring it into the 
acceptable conditions for main parachute deployment. 

FS-1 17: According to Project analysts, the CPAS drogue size was determined by q=45 psf at 
terminal rate of descent 9(33 fps) with 18k load under on drogue chute. 

FS-1 18: The CPAS drogue canopies’ drag coefficient are nominally 0.57 

FS-1 19: The drogue riser and harness legs are constructed from multiple plies of Kevlar® 
webbing (project infers that this improves reliability). 

FS-120: The drogue harness legs are nominally 16 ft. long. 
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FS-121: IDR charts (revised Feb 2009) show the Drogue risers are nominally 65.4 ft. long. 

FS-122: CEV-LRS-08-004 Rev A (Jan 2009), “ODAC-3 Parachute Model Memo” pg 10, shows 
the riser lengths to be 48.8 ft long 

FS-123: IDR (Feb 2009) and CEV-LRS-08-004 Rev A (Jan 2009) are not consistent with respect 
to drogue riser length. 

FS-124: The CPAS drogue suspension lines are nominally 34.5 ft. long. 

FS-125: The length of a Drogue harness leg plus a Drogue riser plus a Drogue suspension line is 
of sufficient total length to meet the wake rule of thumb of four to six times the forebody 
diameter, cited from Section 5.2.2 from Knacke page 5-21. 

FS-126: The table of drogue parachute margins presented in the IDR charts indicates the use of a 
variety of textile materials of various strengths for a variety of parachute components. Nylon 
Ribbon, Kevlar® Tape, and Kevlar® Cord are conventional materials for parachute systems. 
Vectran Cord has been used in parachute systems, but is a more recently developed material; it is 
indicated for use as “soft li nk s.” 

FS-127: Vectran is a thermotropic (melt spun) liquid crystal copolyester fiber produced by 
Kuraray Co., Ltd. (Fort Mill, SC). With comparable yarn tenacity to Kevlar' 29, it has better 
flex-crack/abrasion resistance. Kevlar® fibers are more readily damaged by flexing and sliding 
against themselves, when a fabric is folded. While Kevlar® offers more strength retention at 
higher temperatures than Vectran, Vectran retains its full strength upon cooling and actually gets 
stronger at low temperatures, (ref- Development and evaluation of the mars pathfinder inflatable 
airbag landing system) 

FS-128: Vectran offers less strength retention at high temperatures than Kevlar '. 
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DROGUE 

COMPONENT 

Plies 

IDR - DECEMBER 2008 

Plies 

FEB - 2009 

Crown Ribbons 

1 

PIA-T-5608 2" 300-lb Nylon Ribbon 

1 

PIA-T-5608 2" 300-lb Nylon Ribbon 

Mid Ribbons 

1 

PIA-T-5608 2" 300-lb Nylon Ribbon 

1 

PIA-T-5608 2" 200-lb Nylon Ribbon 

Skirt Ribbons 

1 

PIA-T-5608 2" 300-lb Nylon Ribbon 

1 

PIA-T-5608 2” 200-lb Nylon Ribbon 

Verticals 

1 

PIA-T-5608 0.63" 90-lb Nylon Ribbon 

1 

PIA-T-5608 0.63" 90-lb Nylon Ribbon 

Radials 

1 

PIA-T-87130 1" 4K Kevlar® Tape 

1 

PIA-T-87130 1" 4K Kevlar® Tape 

Vent Band 

2 

PIA-T-87130 1" 6K Kevlar® Tape 

2 

PIA-T-87130 1" 6K Kevlar® Tape 

Skirt Band 

1 

PIA-T-87130 1" 4K Kevlar® Tape 

1 

PIA-T-87130 1" 4K Kevlar® Tape 

1st Stage Reef Line 

1 

PIA-C-87129 4K Kevlar® Cord 

1 

PIA-C-87129 5K Kevlar® Cord 

2nd Stage Reef Line 

1 

PIA-C-87129 5K Kevlar® Cord 

1 

PIA-C-87129 4K Kevlar® Cord 

Suspension Line 

1 

PIA-C-87129 4K Kevlar® Cord 

1 

PIA-C-87129 4K Kevlar® Cord 

Soft Links 

4 

4,500-lb Vectran Cord 

4 

4,500-lb Vectran Cord 

Riser 

8 

PIA-T-87130 1.75" 20K Kevlar® Tape 

8 

PIA-T-87130 1.75" 20K Kevlar® Tape 

Harness 

8 

PIA-T-87130 1.75" 20K Kevlar® Tape 

6 

PIA-T-87130 1.75" 20K Kevlar® Tape 


FS-129: Between December 2008 and March 2009 updates to this data, analysts increased the 
required strength of the first stage drogue reefing line, decreased the strength of the second stage 
drogue reefing line, and decreased the numbers of plies required in the drogue harness legs. 

FS-130: The main parachutes are quarter-spherical ring sail parachutes. The Main Parachute 
Drag Surface incorporates Leading and Trailing Edge reinforcement on all of the individual 
panels. These reinforcements act as “Rip-Stops” to preclude tear propagation. 

FS-131: The Main canopies are nominally 116 ft diameter. The size is driven by pad aborts, 
point 7 on the drogue deploy envelope, wherein drogues are released along with the FBC while 
the drogues are still at the first reefing stage. (Low altitude, low q, high Mach.) 

FS-132: Charts from the IDR (briefed Dec 8, 2008 and revised in Feb 2009) and charts from the 
ERB Orion-09-0355 (Mar 12, 2009) show the main canopies’ combined drag coefficient as 0.94 
for 2 chutes and 0.97 for 3 chutes. 

FS-133: The ODAC-3 Parachute Model Memo, CEV-LRS-08-004 Rev A (Jan 2009), pg 11, 
shows the main canopies’ combined drag coefficient 0.718 for 2 chutes and 0.896 for 3 chutes. 

FS-134: IDR (Feb 2009) and ERB charts are not consistent with CEV-LRS-08-004 Rev A (Jan 
2009), with respect to main chute drag coefficients 

FS-135: The main parachutes Riser and Flarness Legs are constructed from multiple plies of 
Kevlar® webbing. 

FS-136: The Main three harness legs are two at 19 ft long, and one at 16 ft. long. 
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FS- 137 : the Main risers are nominally 97 ft for the harnessed-mains architectural option. The 
Main risers will be longer length for the single -point attachment architectural option, but not 
known. 

FS-138: The Main suspension lines are nominally 133 ft. long. 

FS- 139: The length of a Main harness leg plus a Main riser plus a Main suspension line is of 
sufficient total length to meet the wake rule of thumb of four to six times the fore-body diameter, 
cited from Section 5.2.2 from Knacke page 5-21. 

FS-140: The table of main parachute margins presented in the IDR charts indicates the use of a 
variety of textile materials of various sizes and strengths, for a variety of parachute components. 
Nylon rip-stop cloth, Kevlar® Tape, Nylon Webbing, and Kevlar® Cord are conventional 
materials for parachute systems. Vectran Cord has been used in parachute systems, but is a more 
recently developed material; Vectran cord is indicated for soft links and vent hoops. 

FS- 141 : Vectran offers less strength retention at high temperatures than Kevlar®, (repeat) 


MAIN COMPONENT 

Plies 

IDR - DECEMBER 2008 

Plies 

FEB - 2009 

Crown Rings 

1 

PIA-C-7350 150-200 CFM 3.5-oz Cloth 

1 

PIA-C-7350 150-200 CFM 3.5-oz Cloth 

Mid Rings and Sails 

1 

III 820201 25 CFM 2.25-oz Cloth 

1 

III 820208 80-120 CFM 1.1-oz Cloth 

Skirt Sails 

1 

III 820200 40 CFM 1.17-oz Cloth 

1 

III 820208 80-120 CFM 1.1-oz Cloth 

Radials 

1 

PIA-T-87130 1" 1.5K Kevlar® Tape 

1 

PIA-T-87130 1" 1.5K Kevlar® Tape 

Vent Hoop 

3 

5,250-lb Vectran Cord 

3 

5,250-lb Vectran Cord 

Vent Band 

1 

PIA-W-4088 1" 2.5K Nylon Webbing 

1 

PIA-W-4088 1" 2.5K Nylon Webbing 

Skirt Band 

1 

III 1 19000 1" IK Kevlar® Tape 

1 

PIA-T-87130 1" 1.5K Kevlar® Tape 

1st Stage Reef Line 

1 

PIA-C-87129 4K Kevlar® Cord 

1 

PIA-C-87129 5K Kevlar® Cord 

2nd Stage Reef Line 

1 

PIA-C-87129 4K Kevlar® Cord 

1 

PIA-C-87129 4K Kevlar® Cord 

Suspension Line 

1 

PIA-C-87129 1.5K Kevlar® Cord 

1 

PIA-C-87129 1.5K Kevlar® Cord 

Soft Links 

4 

4,500-lb Vectran Cord 

4 

4,500-lb Vectran Cord 

Riser 

8 

PIA-T-87130 1.75" 15K Kevlar® Tape 

8 

PIA-T-87130 1.75" 20K Kevlar® Tape 

Harness 

14 

PIA-T-87130 1.75" 20K Kevlar® Tape 

18 

PIA-T-87130 1.75" 20K Kevlar® Tape 


FS-142: Permeability of cloth is measured in units of cubic feet of air per minute per square foot, 
abbreviated CFM. 

FS-143: Between December 2008 and March 2009, project analysts apparently reduced the 
required weight of the cloth for the mid rings, mid sails and skirt sails; increased the required 
strength of the s ki rt band and the first stage main reefing line; and increased the numbers of plies 
required in the main harness legs from 14 to 18. 
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FS- 144: Information presented at the December 2008 IDR indicated that the parachute design 
methodology will be: 

1. Begin with the Gen-1 Drogue and Main parachute designs as basis for the Gen-2 designs. 

2. Develop parachute loads from trajectories. 

3. Distribute the loads across parachute elements. 

4. Apply Design Factors (DF) to loads to determine required element strength. 

5. Select elements from known available webbings, cords and cloths based on required 
element strength. 

a. Consider that custom material specifications could be more mass efficient. 

6. Build up parachute weight using material specification weights. 

FS-145: Information presented at the December 2008 IDR indicated that the Design Team would 
apply a Safety Factor (SF) of 1.6 to all components except those whose failure “could result in 
catastrophic failure.” These critical elements have a 2.0 SF: 

• Soft links 

• Drogue vent band 

• Main vent hoop 

• All reefing lines 

• All risers 

• Main harness legs 

FS-146: Knacke Parachute Recovery Systems Design Manual, Table 6-7, recommends a Safety 
Factor (SF) of at least 1.6 and a Design Factor (DF) of 2.21 , for all elements of parachute 
assemblies used for manned vehicles. 

FS-147: The Irvin Recovery Systems Design Guide, Table 8.6, recommends a SF of 1.35 and a 
DF of 23 for manned systems. 

FS-148: The DF is equal to the SF divided by the Allowable Strength Factor (Ap). According to 
the Irvin Design Guide, AFFDL-TR-78-151, page 413-414, the Ap is the product of seven 
individual allowable strength factors, all multiplied by the cosine of the line or riser convergence 
angle from the axis of loading. 

• Joint or seam efficiency 

• Abrasion and wear 
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• Moisture absorption due to humidity, etc 

• Fatigue due to repeated loading or use 

• Temperature 

• Vacuum 

• Asymmetrical or unequal loading 

FS-149: The Table of Main Parachute Margins presented at the IDR in December 2008 showed 
the Main Vent Band DF of 2.21, which meets the Knacke guideline, but does not meet the Irvin 
guideline. 

EO-47: Joint efficiency is a critical component of the Allowable Strength Factor calculation. 

FS-150: Information presented at the December 2008 IDR indicated that the Design Team 
assesses that many Gen-1 joint efficiencies assessed to be below 80% could “be improved to at 
least 80%. ” 

FS-151: Information presented at the December 2008 IDR indicated that the Design Team 
assesses that the main riser and the main harness joint efficiencies cannot be improved to at least 
80%, because they are driven by pin loads. 

EO-48: O: Demonstrating V&V for drogue and main parachute structures could result in a 
significant amount of testing. If all joints are tested, this could tax test facilities. 

EO-49: Review of Gen 1 test reports suggests that in 2007 and 2008 there was a lack of a 
systematic process in establishing the basis for and the conduct of testing. 

Parachute Attach Fittings 

FS-152: The Apollo ‘flower pot’ fitting attached to the CM at 0° (the ’crew heads up’ direction), 
mid-way between two gussets (45° and 315°). The fitting reacted drogue and main parachute 
loads. 

EO-50: Six CEV CM LAS Wells are sized for substantial loads from launch abort conditions. 

FS-153: LAS Wells are located at the base of each of the six forward bay gussets. 

FS-154: Six CEV CM forward bay gussets (Al-Li) are FSW welded along two orthogonal sides, 
to the forward bay bulkhead (monolithic integrally machined Al-Li structure) and to the tunnel 
(monolithic integrally machined Al-Li structure). 

FS-155: For all CPAS architectural options, the drogue parachute loads are transmitted through 
the FBC and reacted by the CM gussets at 60°, 180°, and 300°. 
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FS-156: For the CPAS hamessed-mains architectural option, main parachute loads are reacted at 
the base of CM gussets at 0°, 120 °, and 240 °. 

FS-157: For the CPAS single-point attach main architectural option, three main parachute attach 
fittings are integrated into the CM’s 0° gusset, midway up its length. 

EO-50b: Integrating three main parachute attach fittings are into the CM’s 0° gusset, midway up 
its length may not allow for sufficient riser excursion during parachute deployment. 

FS- 158: For the CPAS single-point attach main architectural option, CPAS assumes load share 
main attach fitting load share of 50% / 25% / 25%. 

EO-50c: The CPAS load share assumption on main attach fittings of 50% / 25% / 25% will have 
to be verified by appropriate main chute cluster tests. 

FS- 1 59: According to Airborne charts from a Feb 3, 2009 presentation, Apollo designed main 
attach fittings (flowerpot assembly) to the assumed load share of 40% - 40% - 20%. 

EO-50d: The Apollo load share assumption on main attach fittings of 40% - 40% - 20% were 
verified by instrumented aerial drop tests. 

EO-5 1 : For the CPAS single-point attach main architectural option, if main risers have wrapped 
more than one complete turnaround each other during deployment, the loads from multiple 
inflating canopies may all react though one riser beneath the twist point. This could affect torque 
limiter function and could result in high loads on just one attach fitting. 

EO-52: If significant design changes are required for to the CEV CM 0° Gusset to accommodate 
the CPAS single-point attach architectural option, detailed coordination with Lockheed designers 
and analysts is essential to recognize integration issues as soon as possible. The 0° Gusset may 
need to be assessed as Design for Minimum Risk (DFMR). 

Deployment Bag Handles and Energy Modulators 

FS-160: In the loosely-attached mains architectural option described in the December 2008 IDR, 
each main d-bag is attached to the FBC by four bag handles of 20,000 lb Kevlar® Tape each, 
two on each side of the d-bag. 

FS-161: In the loosely-attached mains architectural option described in the December 2008 IDR, 
Energy Modulators are incorporated into the bag handles, to reduce snatch forces. 

EO-53: The geometry of the d-bags suggests that the d-bags centers of gravity will be offset 
outboard (radially, away from the tunnel) from the attach locations of the four bag handles. If the 
d-bags centers of gravity are outboard from the handles, then the extraction forces acting on the 
d-bag handles as the bags are lifted, would impart a pitching moment on the bags. This moment 
may be sufficient for the lower back edge of all of bags to contact (slide along or strike against) 
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the tunnel during extraction. This could be a common cause source of damage to all three main 
d-bags. 

FS-162: Energy modulators are sewn-together double-lengths of fabric that as they are loaded, 
tear apart. The tearing spreads the energy of a rapidly applied force over a longer period of time. 

FS-163: Energy modulators are incorporated into d-bag bag handles for the loosely-attached 
mains architectural option. 

FS-164: The effectiveness of energy modulators in this application may be reduced if a d-bag’s 
extraction from its stowed location is delayed by contact (drag across, slide along or strike 
against) with CM structure. 

Kicker Straps 

FS-165: Kicker strap concepts were shown that use ki netic energy from the separation of the 
FBC away from the CM after release, provided by drogue parachute forces, to impart energy to 
main d-bags in a radial direction while they are being extracted, for FBC-deployed main 
parachute architectural options. 

FS-166: Kicker straps as envisioned for FBC-deployed main parachute architectural options may 
reduce the risk of near field contact (drag across, slide along or strike against) of main d-bags 
with CM tunnel and gussets during extraction from their stowed locations. 

FS-167: Kicker straps as envisioned for FBC-deployed main parachute architectural options may 
not reduce the risk of near field contact (drag across, slide along or strike against) of main d-bags 
with CM FAS Wells during extraction from their stowed locations. 

FS-168: Kicker straps as envisioned for FBC-deployed main parachute architectural options may 
increase the risk of near field contact of main d-bags with FBC structure, by imparting a pitching 
moment as they impel d-bags radially away from the CM, with the FBC still proximal. 

EO-53b: Kicker Strap concepts that use some of the energy from the force provided by the pilot 
parachute at inflation, to impart energy to main d-bags in a radial direction while they are being 
extracted should be physically conceivable. 

Rotation Torque Limiter 

FS-169: The PTRS requires CPAS to limit the torque required to roll the CM about the gravity 
vector prior to landing while suspended by its main parachute system, to less than 450 ft-lbs., to 
allow the RCS to maintain the crew’s feet oriented towards the horizontal direction of travel 
prior to landing. 

FS-170: For the hamessed-mains architectural option, a rotation torque limiter would stow 
beneath the confluence fitting in a stowage container attached to the CM in sector D. 
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FS-171: For the hamessed-mains architectural option, when the three harness legs deploy, the 
torque limiter would ride up to its functional height, restrained from going higher by restraining 
cords. The section of the three harness legs between the confluence fitting (on top) and the 
torque limiter (on bottom) would be allowed to twist up and untwist, depending on the 
commands from the RCS. According to information communicated at the December 2008 IDR, 
this distance would be nominally 6 ft. This would be the effective length of harness that would 
be allowed to twist up in response to RCS commands. 

EO-54: The remaining harness leg lengths from the torque limiter to the CM attach points would 
be nominally 10 feet each. 

FS-172: The torque limiter system includes restraining cords that are nominally 20 feet long 
(twice the length of remaining harness leg lengths), and are intended to assure that after 
deployment, the three harness legs lengths from the torque limiter to the CM attach points would 
all be the same length. 

FS- 173: The torque limiter system includes securing ties to hold three harness legs in a “triangle” 
arrangement while deployed. 

EO-55: Failure of restraining cords and securing ties are possible during deployment, from 
contact (dragging across, sliding along or striking against) with CEV structure. 

FS-174: Failure of two torque limiter restraining cords is necessary for one harness leg remaining 
length to deviate from nominal. This feature provides redundancy against loss of intended 
function. 

FS-175: Failure of one torque limiter securing tie could allow one harness leg to become 
unseated from its place in the torque limiter, if the assembly is twisted. This feature has no 
redundancy against loss of intended function. 

EO-56: The team was unaware of systems that included hardware similar in function to the 
described rotation torque limiter. 

FS-176: The ICD drawing of the rotation torque limiter showed a version that was sized with 
recesses in which tapes would seat that are two inches wide including a 0.25 inch radius on each 
side, and with a harness installation clearance of 1.063 inches. This design appears to 
accommodate three tapes (harness legs or riser) with a maximum size of two-inch wide by one- 
inch thick. The drawing also showed hole provisions for routing securing ties across the inner 
surfaces of all three tapes. It also showed hole provisions for routing restraining cords. Various 
versions of the torque limiter could be manufactured. 

EO-57: Installation of Kevlar® tapes (harness legs or risers) would allow a space between the 
inner surface comers of adjacent tapes, in the untwisted condition. This space would close as 
twists are added. The number of twists at which the spaces close to zero will be a function of the 
width and thickness of the tapes, and the dimensions of the torque limiter. 
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FS-177: In the single-point attach architectural option, the stowage location for the torque limiter 
was not specified. 

EO-58: In the single-point attach architectural option, the restraining cord feature cannot 
maintain the torque limiter at its intended height for proper function. When the three risers 
deploy, the torque limiter would have to “be” at its functional height. 

EO-59: Assuming the upper limiter would be retained at its functional height by another method, 
the section of the three risers between the upper limiter and the lower limiter (at the gusset) 
would be allowed to twist up and untwist, depending on the commands from the RCS. This 
distance was not found in information reviewed by the NESC team, but is probably 6 ft by 
similarity with the other architectural option. 

FS-178: If CPAS utilizes a set of two rotation torque limiters for the single-point attach 
architectural option, with a lower torque limiter integrated into a CM gusset, and a flying upper 
torque limiter, deployment of the upper torque limiter may contact (strike against) CEV structure 
as it is extracted from its stowed location. Riser routing may limit the location of a stowage box 
for the upper torque limiter to sectors A or F, the two sectors that are adjacent to the 0° gusset. 
These two sectors contain the drogue mortars, one in each. 

EO-60: In the single-point attach architectural option, if a main riser fails, the failure of a second 
riser may not be an independent event, given the confluence and arrangement of the three risers 
passing through the rotation torque limiter. One slack Kevlar® tape may bind or interfere with 
the two remaining taut tapes still under tension, causing their unexpected shifting in the torque 
limiter, and consequently damaging a second tape. 

EO-61: In the harnessed-mains architectural option, if a main harness leg fails, the failure of a 
second harness leg may not be an independent event, given the confluence and arrangement of 
the three harness legs passing through the rotation torque limiter. One slack Kevlar® tape may 
bind or interfere with the two remaining tapes still under tension, causing their unexpected 
shifting in the torque limiter, and consequently damaging a second tape. 

Stowage Container 

EO-62: In the harnessed-mains architectural option, there are risks of disorderly extraction of the 
contents of the stowage container installed in sector D. The container contents (confluence 
fitting, torque limiter, harness legs), could be damaged by contact (drag across, slide along or 
strike against) with the CM structure. The container contents could be hindered or prevented 
from being deployed. 

EO-63: In the single-point attach architectural option, the rotation torque limiter may be stowed 
in a container in Sector A or Sector F (the sectors nearest the 0° Gusset attach location), or may 
be stowed in a forward bay location without a container. If stowed in a container, there is a risk 
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that the torque limiter could be hindered or prevented from being deployed. Whether stowed in a 
container or not, there is a risk of the torque limiter contacting CM structure. 

EO-64: Failure of the torque limiter will prevent CEV roll control prior to splashdown. 

Drogue Mortars 

FS-179: All of the CPAS architectural options have two drogue mortars - one each, in sectors A 
and F of the CM forward bay. 

FS-180: The mortars will be provided to Airborne by a subcontractor. 

FS-181: An ICD drawing provided showed the mortars to be 1.13 ft diameter with 1.58 cubic ft 
of volume, (depth 1 .4 ft) 

FS-182: The mortars have two initiators and two bridge wires, providing redundancy. 

FS-183: The mortars are attached to the FBC and remain with the FBC after FBC/CM 
separation. 

FS-184: Apollo conducted tests to characterize mortar propellant degradation with age, and with 
exposure to full mission environmental conditions including thermal cycles. 

FS-185: The CPAS project explained at a February 2009 teleconference that they also would 
conduct tests to characterize mortar propellant degradation with age, and with exposure to 
thermal cycles. 

FS-186: Packing the confluence ring inside the drogue mortar, on top of the riser and drogue 
parachute, complicates successful expulsion of the contents of the mortar. 

EO-64b: Packing the confluence ring inside the drogue mortar, on top of the riser and drogue 
parachute might result in more controlled motion of the ring during deployment. 

FS-187: Apollo coiled their (steel) drogue risers and encased them in foam disk to improve 
reliability of expulsion from mortar, eliminating the possibility of developing kinks in the cables. 

FS-188: The project calculates the drogue pack density to include the confluence ring mass. This 
is unnecessarily conservatively and misrepresents the risk of damage to drogue structural 
components from high density packing. 

FS-189: According to information discusses at a March 2009 ERB, the project recognizes the 
risks associated with a mortar having insufficient energy to eject all of its contents from the 
mortar with sufficient velocity to inject the drogue d-bag (“last out”) far enough into the air 
stream to begin inflating. 

FS-190: Vehicle attitude relative to direction of travel and wind direction can introduce an 
additional hindrance to successful extraction of drogue mortar contents. 
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EO-65: A weak- fired mortar poses a risk of a failure to fully extract a drogue d-bag from the 
mortar tube, leaving its confluence ring potentially impacting against the side of the CM, or 
worse, becoming an entanglement hazard for other CPAS components as they deploy from 
adjacent sectors. 

EO-66: There may be risk of a metallic confluence ring contacting the mortar tube’s edge on its 
way out, causing surface damage that subsequently damages a d-bag during its exit. 

Apportionment of Parachute System Components in the Forward 
Bay Sectors 

FS-191: Parachute growth capacity is limited due to confined space. 

FS-192: The Apollo design stowed a variety of landing and retrieval hardware and equipment in 
the four sectors of its forward bay, including but not limited to: 

• three main parachute d-bags each with a canopy, suspension lines, and some lengths of a 
riser inside 

• various lengths of three main parachute risers outside the d-bags 

• three main parachute pilot chute mortars 

• two drogue parachute mortars each with a sabot, a d-bag, a canopy, suspension lines, and 
some lengths of a riser inside; the riser was coiled and encased in a foam disc. 

• two equal lengths of two drogue parachute risers outside the mortars 

• a so-called ‘flower-pot’ parachute fitting attached to the CM between two gussets (45° 
and 315° with 0° being the ’crew heads up’ direction) where drogue and main parachute 
riser loads were transferred to the CM structure 

• CM uprighting system 

• Antennas and location aids 

FS-193: The CEV design architectures under consideration by the project between 
December 2008 and March 2009 each also allocated stowage for a variety of hardware and 
equipment in the six sectors of its forward bay. Assuming the dual drogue harness architectural 
option, and excluding retention hardware, these stowed items include but are not limited to: 

Three-leg-hamess main parachute CPAS architectural option 

• three main parachute d-bags each with a canopy, suspension lines, and some lengths of a 
riser inside 

• various lengths of three main parachute risers outside the d-bags 
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• one metallic main parachute rotation torque limiter 

• one metallic main parachute confluence fitting 

• two 19-ft harness legs, and one 16-ft harness leg 

• one large stowage container for rotation torque limiter, confluence fitting, and excess 
riser and harness legs 

• (no main parachute pilot chute mortars for either architectural option) 

• two drogue parachute mortars each with a sabot, a d-bag, a canopy, suspension lines, and 
some lengths of a riser inside, plus a metallic confluence ring and a short length of one 
harness leg 

• (remaining lengths of drogue parachute harness legs are routed from the mortar tubes 
outside the FBC, and stowed outside on top of the FBC) 

• three main parachute attach fittings attached to the CM at the lower extremity of three of 
the six gussets (0°, 120°, 240° with 0° being the ‘crew heads up’ direction) 

• three pilot parachute packs and extraction lines - if pilot-deployed-mains architectural 
option 

• CM uprighting system (presumed) 

• Antennas and location aids (presumed) 

Single-point-attach main parachute CPAS architectural option 

• three main parachute d-bags each with a canopy, suspension lines, and some lengths of a 
riser inside 

• various lengths of three main parachute risers outside the d-bags 

• one metallic main parachute rotation torque limiter 

• one smaller stowage container for rotation torque limiter and excess riser lengths 

• (no main parachute pilot chute mortars for either architectural option) 

• two drogue parachute mortars each with a sabot, a d-bag, a canopy, suspension lines, and 
some lengths of a riser inside, plus a metallic confluence ring and a short length of one 
harness leg 

• (remaining lengths of drogue parachute harness legs are routed from the mortar tubes 
outside the FBC, and stowed outside on top of the FBC) 
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• a second metallic rotation torque limiter, integrated halfway up the CM’s 0° gusset (‘crew 
heads up’ direction), three main risers pass through one hole, the three belt-cross section 
risers making a 120° angle with each other. 

• three main parachute attach fittings integrated into the CM’s 0° gusset, at three places 
beneath the gusset-pass-through location. 

• three pilot parachute packs and extraction lines - if pilot-deployed-mains architectural 
option 

• CM uprighting system (presumed) 

• Antennas and location aids (presumed) 

FS-194: Apollo used approximately 75% of the available volume of its forward bay - three of 
four sectors (each sector defined by a pair of gussets) - as stowage volumes for three main 
parachutes. Each of these three volumes also contained one main pilot parachute mortar and one 
CM uprighting bag. The fourth sector in the Apollo design contained two drogue mortars, one 
flower-pot attach fitting, and much of all the remaining hardware stowed in the forward bay. 

FS-195: As reviewed between December 2008 and March 2009, the Orion CEV allocates 50% of 
the available volume of its forward bay - three of six sectors defined by pairs of gussets - as 
stowage bays for three main parachutes. 

FS-196: Assuming all things are scaleable, the CPAS Project is being asked to achieve a 33% 
reduction in the stowed volume of its main parachutes - from 75% of available volume to 50% 
of available volume. 

EO-67: Advances in parachute design and materials technology since the development of the 
Apollo ELS could possibly achieve a 33% reduction in required volume for the parachute packs 
(proportionally compared to Apollo), but if not, an overaggressive reduction may introduce new 
reliability risks for CPAS that may adversely affect the overall probability of LOC. 

FS-197: Apollo used portions of its remaining sector for stowage space for short lengths of 
drogue risers, short lengths of main risers and two drogue mortars, of which the latter used the 
majority, proportionally. Apollo mortar sizes were increased during vehicle development due to 
CM weight increases and subsequent increases in drogue parachutes. 

FS- 198: CPAS has been allocated portions of the CEV’s remaining three (of six) sectors in its 
forward bay, for stowage space for main harness legs, medium lengths of main risers, a 
confluence fitting, a torque limiter, a storage box, and two drogue mortars. In some architectural 
options under consideration by the project between December 2008 and March 2009, the harness 
legs and confluence fitting has been deleted. 
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EO-68: Orion CEV might have a requirement that demands more of the available volume of the 
forward bay (proportionally compared to Apollo), for hardware that is not related to CPAS. If 
this is true, then if these systems are not related to crew survival, design trades between these 
items and CPAS components should not be made if they introduce new reliability risks for CPAS 
that may adversely affect the overall probability of LOC. 

EO-69: Using four of six sectors on the CEV forward bay for four main parachutes would 
provide 66% of the available volume for packed parachutes. Assuming all things are scaleable, 
this would provide for at least a 12% improvement based on advances in parachute design and 
materials technology since the development of the Apollo ELS (from 75% of available volume to 
66% of available volume). 

EO-70: A CPAS architecture with four main parachutes instead of three, could introduce new 
reliability risks for CPAS that may adversely affect the overall probability of LOC. Technical 
assessment is necessary to establish the merits and demerits of such an architecture. 

EO-71: One architectural option that addresses many of the NESC team’s recommendations 
comprehensively would include: 

• Four main parachutes in four d-bags stowed in sectors B, C, D, and E, that could be 
smaller, less dense, and possess volume reserve. 

• Total 4-pack volume that could be 20% greater than the assessed 3 -pack total volume, 
representing 60% of total forward bay volume, rather than 50%. 

• This would be achieved with a 5% growth in total parachute mass, a 5% decrease in the 
size of each pack, a 5% decrease in pack density, and still retain a 5% volume reserve 
going into PDR. 

• One failed main would represent 75% capability rather than 66% capability. 

• Smaller main pack shapes can be simplified, possibly avoiding wrapping around the LAS 
Wells. 

• Redundant Kicker straps. 

• Single point attach at Gusset 0. Gusset assessed as DFMR. 

• One DFMR steel riser, one DFMR confluence fitting, and four fabric risers. 

• No torque limiter. The steel riser will twist-up to minimize rotation torque, between the 
gusset attach and the confluence fitting. 

Project Technical Requirements Specification (PTRS) 
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FS- 199: A preliminary draft of CPAS Requirements (Project Technical Requirements 
Specification, PTRS) was published in October, 2008, and provided to the NESC team at the 
IDR in December 2008. 

FS-200: The PTRS and an associated document called the “Assumptions document” got final 
signatures in January 2009 (double check), and both were provided to the NESC team. 

FS-201: Significant changes were made to the PTRS and assumptions documents between 
December 2008 and March 2009. 

FS-202: The initial conditions for drogue mortar firing defined in the PTRS for CPAS are 
incomplete. 

FS-203: Appropriate and validated parachute analysis tools will be critical to the design of CPAS 
and the verification of requirements. 

FS-204: [I.CPAS.CM.006] CPAS shall limit the vertical descent rate of the CM to less than 
10.07 m/s (33.0 ft/s) at standard sea-level conditions (as defined in NASA-TM-X-74335, U.S. 
Standard Atmosphere, 1976) for a maximum CM mass of 9,464.2 kg (20,865.0 lbm). (PTRS, 
October 2008) 

FS-205: It will be difficult to statistically verify requirement since it is written in absolute terms. 
[I.CPAS.CM.006], 

FS-206: [R.CPAS.018] CPAS shall meet all functional and performance requirements of this 
specification when subject to one drogue parachute and one main parachute failure. Rationale: 
This requirement refers to a complete loss of one drogue and one main parachute on the same 
landing event. Each subcomponent of CPAS (drogues and mains) should be one fault tolerant. 
(PTRS, October 2008) 

FS-207: Requirement [R.CPAS.018] does not explicitly include the possibility that one drogue 
parachute will fail without the subsequent failure of one main parachute. 

FS-208: [I.CPAS.CM.011] CPAS shall limit the peak total parachute load (3-sigma) to less than 
the peak loads defined in Table 3.3-1, Parachute Peak Loads, under all fault conditions defined in 
[R.CPAS.018], [R.CPAS.017], and [R.CPAS.129]. Rationale: These peak loads define the 
extreme load to which the CM design will be based. While the CPAS is not required to design 
the parachutes to survive the skipped reefing stages defined in [R.CPAS.018], these failures must 
not impart more load into the CM and load-carrying structures than listed here to prevent the 
failure from propagating into a catastrophic failure. (PTRS, October 2008) 

FS-209: Requirement [I.CPAS.CM.011] does not specify a limit peak parachute load under the 
(most likely) nominal condition where there is no fault in the system. 

FS-210: Requirement [I.CPAS.CM.011] does not limit the direction in which the parachute peak 
loads are applied. 
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FS-21 1: [R.CPAS.012] CPAS shall design to meet or exceed the load dispersions for each fault 
case defined in Table 3.3-2, Parachute Load Dispersions. Rationale: Load dispersions result from 
Monte Carlo analyses which vary performance parameters. Designing for 3-sigma dispersions in 
low likelihood cases drives up mass for very little return in overall reliability. For the purposes of 
this requirement, the analyses will vary all relevant parachute performance parameters (drag 
area, opening shock, cutter times, etc.), and all initial conditions defined in [R.CPAS.005], 
[I.CPAS.CM.128], [I.CPAS.CM.129], [I.CPAS.CM.132], [I.CPAS.CM.133], [I.CPAS.CM.134], 
[I.CPAS.CM.135] and [I.CPAS.CM.139]. The analyses results assume the use of 3 main and 2 
drogue parachutes in the CPAS configuration. Trajectory conditions will be assumed at the edges 
of the deploy trajectory envelope defined in [R.CPAS.005] and use NASA-TM-X-74335, U.S. 
Standard Atmosphere, 1976. (PTRS, October 2008) 

FS-212: Requirements [R.CPAS.012] is silent on whether the parachute that had a skipped 
reefed stage remains operational or not. 

F-213: Using multiples of “sigma” in specifying requirement [R.CPAS.012] may yield an 
unacceptable percentile of cases that exceed the specified loads since this percentile depends not 
just on “sigma,” but also in the probability distribution, which is not kn own up front. 

FS-214: PTRS fig 3.1-1 is not clear whether “roll rate” refers to wind or body axis. (PTRS, 
October 2008) 

FS-215: Project is using Monte Carlo dispersions generated by DSS simulations to set the 
Requirement for CEV attitude at drogue deployment at +/- 70°. 

Analysis, General 

EO-72: Appropriate and validated parachute analysis tools will be critical to the design of CPAS 
and the verification of requirements. 

FS-216: A tool called Decelerator Dynamics (DCLDYN) is an in-house FORTRAN analysis tool 
used by Airborne for two-body dynamic analysis of a parachute and an item of cargo suspended 
beneath the parachute. The two simulated bodies are connected by a nonlinear spring 
representing the riser, the suspension lines, and the canopy’s radials. Each body is modeled with 
3 DOF: vertical (along the axis between the two bodies), horizontal (perpendicular to that axis), 
and pitch. Roll and yaw cannot be analyzed. 

FS-217: DCLDYN models represent other parachute- specific features, such as drag and mass as 
a function of time; disreefing schedules; parachute opening parameters; parachute shape and time 
parameters. 

EO-73: DCLDYN appears to be the Design Team’s principal analysis tool. 
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FS-218: It is not clear how DCLDYN has been validated for use to compute numbers that are 
used to justify significant design decisions. 

FS-219: Design Team analysts use DCLDYN to account for a phenomenon wherein a percentage 
of parachute mass reaccelerates towards the cargo velocity at line stretch. 

FS-220: DCLDYN analysis accounts for apparent mass effects wherein a parachute mass 
increases during inflation, as the mass of air ‘inside’ it increases. 

FS-221: DCLDYN cannot model a cluster of multiple parachutes. Spreadsheet simulations are 
constructed to model multiple parachutes. The spreadsheet simulations do not include a 
nonlinear spring parameter to represent the riser/lines/radials. Ratios determined from the 
spreadsheet simulation are used in a subsequent DCLDYN simulations. 

FS-222: During a teleconference with the NESC team in February 2009, the project lead 
indicated an intention to run a NASA analysis tool, Dynamic System Simulator (DSS) for checks 
of DCLDYN. 

FS-223: DSS is a NASA high-fidelity code that can be used for dynamic analysis of parachutes 
and items of cargo. 

FS-224: A review of Gen-1 test reports revealed that DCLDYN mispredicted opening load and 
inflation time of the pilots, drogues, and mains. 

FS-225: A review of Gen-1 test reports revealed that results from both DCLDYN and DSS were 
used by the project but no direct comparison of DSS and DCLDYN results were ever shown. 
Results from one analysis tool were always presented independently from the other. 

FS-226: A review of Gen-1 test reports revealed that a migration by the Design team from using 
predominantly DCLDYN in CY 2007, and increased use of both DCLDYN and DSS in CY 
2008. 

FS-227: During a teleconference with the NESC team in February 2009, the project indicated an 
intention to run a less-detailed analysis tool known as OSIRIS for verification analysis and 
requirements closure. (Integrated GNC Design and Data book, Section 9.1.4.) 

FS-228: POST is a generalized point mass, discrete parameter targeting and optimization 
program that provides the capability to target and optimize point mass trajectories for multiple 
powered or unpowered vehicles near an arbitrary rotating, oblate planet. POST is supported by 
NASA LaRC. 

EO-74: Using two different codes, such as DCLDYN and DSS or POST and DSS, has in 
previous projects resulted in revelation of shortcomings of each code, and improved confidence 
in results. 

Analysis, Specific Issues 
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EO-75: Validation, verification, and/or calibration are planned by CPAS to support uncertainty 
estimates on results that feed into the reliability estimates. 

FS-229: LS-DYNA is an advanced general-purpose multiphysics simulation software package 
that is actively developed by the Livermore Software Technology Corporation (LSTC). 

FS-230: The project has used LS-DYNA to determine preliminary Kevlar® harness hysteresis 
curves, to establish the appropriate main harness leg lengths that would provide the required 
hang angle at landing. 

FS-231: According to charts prepared for a brief by CPAS to a Lockheed Engineering Review 
Board in March 2009, the project intends to use LS-DYNA for simulation of separation of the 
FBC from the CM. 

FS-232: Project analysts have run Monte Carlo analyses with DCLDYN for stochastic 
nondeterministic problems. 

FS-233: Results from DCLDYN Monte Carlo analyses of drogue parachute loads were presented 
at the December 2008 IDR. Results represented all seven points of the deployment envelope, and 
included analyses of an aggressive disreefing schedule for deployment after pad abort. 

FS-234: Results from DCLDYN Monte Carlo analyses of drogue parachute loads presented at 
the December 2008 IDR indicated that input dispersion for the analysis included 5 parameters for 
the CM, and between 16 and 19 parameters for a parachute that was modeled to represent two 
drogue parachutes as one. 

FS-235: The DCLDYN Monte Carlo analyses of drogue parachute loads presented at the 
December 2008 IDR showed all input dispersions were based on Gen-1 data. 

FS-236: The DCLDYN Monte Carlo analyses of drogue parachute loads presented at the 
December 2008 IDR used uniform dispersions for all parameters. Presented charts indicated a 
plan to review the distribution types for future analyses. 

FS-237: The CPAS IDR charts showed the Monte Carlo analysis used uniform dispersions for 
the dispersed parameters. Design requirements state analysis will show CPAS performance to 
meet the requirements to a specified sigma value, assuming normal distributions. Monte Carlo 
results using uniform dispersions will likely not fit a normal distribution well, given the 
parameter space shown in the IDR. 

FS-238: The CPAS IDR charts showed a mass reduction for not having the skipped reefing stage 
requirement. There was no skipped reefing stage requirement for Apollo. To protect for this, 
extra reefing lines and cutters were incorporated into the design. These extra reefing lines were 
however required to meet Apollo reliability requirements (pg 23, “The Apollo Parachute 
Landing System,” Knacke). 
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FS-239: There are only 2 simulations apparently being used in making design decisions, 
DCLDYN and DSS. The 2 simulations are working closely and not independently. 

FS-240: System definitions and data are provided across a broad range of documents. 
Configuration documents have been found in PDF, Word, and PowerPoint format. Some of the 
documents contradict each other (dispersions). 

FS-241: DCLDYN Monte Carlo analyses were also run to assess drogue and main riser loads 
sensitivities to other parameters. 

FS-242: Limit load requirement for drogues is 55,000 lb (either or both drogues). 

FS-243: Results from DCLDYN Monte Carlo analyses of main parachute loads presented at the 
December 2008 IDR indicated that some design load requirements were exceeded for that 
preliminary look. 

FS-244: Peak drogue riser load at initial opening to 1 st stage, was found to be most sensitive to 

• Initial pitch angle of vehicle 

• 1 st stage reefing ratio 

• 1 st stage fill constant 

• 1 st stage Ck 

FS-245: Peak drogue riser load at disreef from 1 st stage to 2 nd stage, was found to be most 
sensitive to 

• 2 nd stage reefing ratio 

• 2 nd stage Ck 

• 1 st stage reefing ratio 

FS-246: Peak drogue riser load at disreef from 2 nd stage to full open, was found to be most 
sensitive to 

• 3 rd stage Ck 

• 2 nd stage reefing ratio 

FS-247: Peak main riser load at initial opening to 1 st stage, was found to be most sensitive to 

• 1st stage fill constant 

FS-248: Peak main riser load at disreef from 1st stage to 2nd stage, was found to be most 
sensitive to 

• 2nd stage reefing ratio 
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FS-249: Peak main riser load disreef from 2nd stage to full open, was found to be most sensitive 
to 


• 2nd stage reefing ratio 
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Testing, General 

FS-50: Prior to October 2008, Airborne performed demonstration testing of various elements of a 
“Generation 1” parachute system to develop data that was expected to have utility for CPAS 
development. 

FS-251: The system architecture briefed in December 2008, is so-called ‘Generation-2,’ differed 
in significant ways from the Generation- 1 architecture. 

FS-252: Some Gen-1 test data is applicable to the Generation-2 system. 

EO-76: A great deal of developmental ground and flight testing will be necessary to qualify 
any of the CPAS architectural options that were reviewed by the NESC Team between 
December 2008 and March 2009. 

EO-77: Testing conducted by the project between December 2008 and March 2009, appeared to 
lack a methodological approach. 

EO-78: Testing conducted between December 2008 and March 2009 appeared to be principally 
for the means of evaluating design concepts. 

FS-253: No Gen-2 verification and validation testing was accomplished between December 2008 
and March 2009. 

FS-254: Between December 2008 and March 2009, a test matrix was not available for the NESC 
team to review. 

FS-255: The project’s draft V&V Plan will not be available until near PDR. 

EO-79: All testing conducted, including development, should be done in support of the design 
effort, building confidence in the design, and eventually qualification. 

EO-80: The Verification and Validation matrix should address all requirements set forth in the 
ICD and the PTRS. 

EO-81: The project has not clearly identified what is required to pass through the gate of PDR. 

EO-82: Given the broad range of initial/boundary conditions on the CPAS performance envelope 
for the CPAS and the expense of testing, the final certification of CPAS is likely be highly 
dependent upon modeling and simulation results. Modeling and simulation results are only valid 
after the model(s) is(are) thoroughly understood, the application limits have been established, 
have been deemed valid for use in the application, and have been verified by test data and/or 
comparison to other models and we have heard very little of any plans for such a V&V program. 
A rigorous review process must be applied for the validation and verification test program used 
to certify a modeling based approach. 

FS-256: Revision of PTRS in March 2009 changed the following: 
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• An update to the CPAS drogue deploy envelope was made. 

• The pad abort, main parachute deployment initiation requirement was deleted. 

• The CM hang angle requirement was deleted. 

• Requirements were reworded to be better defined. 

• Drogue parachute pack mass was stipulated to be 31.5 kg (69.5 lbm). 

• Operational temperature bounds were changed from -54 C (-65 F) to -83 C (-1 17 F). 

• The gaseous methane and oxygen requirements were deleted. 

• Main and drogue parachute failure tolerance requirements were revised for nominal entry 
and pad aborts. 

Testing, Specific Issues 

EO-83: The Apollo Experience Report - Earth Landing System (ELS), NASA TN D-7437, 
(1973), illustrates the extent of the testing that was necessary to demonstrate the overall 
reliability of the ELS system, to make it suitable for manned flight. It also illustrated the need for 
thorough systems integration and compatibility verification. 

FS-257: The Apollo Experience Report - ELS does not contain data useful for creating reliability 
estimates. 

FS-258: Some quantitative Apollo data useful for creating reliability estimates is in the Knacke 
Book. 

FS-259: The Northrop Venture report 4040, Apollo Earth Landing System, report of reliability 
Analysis (1968) could not be located by individuals at Northrop who are contracted with the 
NESC for other purposes. 

FS-260: Developmental test data from Apollo Earth Landing System that might be useful to 
CPAS reliability assessments is not readily available. 

FS-261: The Gen-1 forward bay full-scale mockup shown in pictures in IDR charts lacks 
significant geometric details including LAS Wells, integrally machined features on the tunnel, 
and features on the gussets. 

FS-262: The project’s first draft Test Matrix is not expected until after March 2009. 

FS-263: the project’s first draft Verification and Validation plan is not expected until closer to 
the project’s PDR (NLT September 2009.) 
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FS-264: According to a chart presented by the S&MA Team in February 2009, a draft plan for 
methods to generate reliability data included the following: 


Function 

Method 

Main / Drogue Confluence Fitting 

Cluster Test 

Environment Induced Failure 

Historical / Test 

Rigging Error (Main + Drogue) 

Historical Data 

Far-Field Contact 

Auxiliary Test 

Near-Field Contact 

Ground Testing 

Main Chute Entanglement 

Flight Testing 

Drogue / Auxiliary Entanglement 

Flight Testing 

Skipped Reefing Stage Failure 

Historical Data 

Chute Deployment Failure 


Friction Failure Due to Rapid Extraction 

Historical / Test 

Disorderly Deployment 

Historical Data 

Inadvertent Chute Release 

Integrated 

Bag Cutter Failure 

NSI + Integrated 

Single Chute Near-Field Contact 

Ground Testing 

Inflation Failure 

Historical Data 

Failure Due to Extraction Line Load Too High 

Unknown 


FS-265: The table indicates that the project recognizes that for the dual drogue confluence fitting 
architectural option, cluster testing is necessary to verify and validate load sharing assumptions 
and to generate data of the probability of damage to one or both confluence rings during 
deployment. 

EO-84: There is risk of damage to one or both drogue confluence rings between deployment 
from drogue mortars and line stretch from: 

• Impact with the mortar while exiting the tube 

• Impact with the mortar cover during or after exiting the tube 

• Impact with each other 

• Impact with FBC structure 

• Impact with CEV structure 
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FS-266: The table indicates that the project recognizes that for the harnessed-mains architectural 
option, cluster testing of the main confluence fitting is necessary to validate load sharing 
assumptions. 

FS-267: The table indicates that the project recognizes that environmental laboratory testing is 
necessary where test data does not already exist. 

FS-268: The table indicates that the project recognizes that historical data is necessary to 
estimate the probability of failure of main or drogue inflation due to errant rigging. 

FS-269: The table indicates that the project recognizes that testing is necessary to verify and 
validate the reliability of the auxiliary chute system which is intended to decelerate the FBC after 
release, so as to reduce the risk of its subsequent interference with one or more inflated main 
parachutes, main suspension lines, main risers, or main harness. 

FS-270: The Apollo Block II ELS forward heat shield (FHS) incorporated a 7.2 ft auxiliary 
chute, the same one used as pilot parachutes for main chute deployment. The auxiliary chute’s 
mortar was redesigned to fit in the available volume that was inside the heat shield adjacent to 
the top of the tunnel. 

FS-271: The Apollo Block II ELS aux chute mortar was initiated by a time-delayed distance- 
switch on a short lanyard that pulled tight during cover separation as the cover cleared the tunnel. 

FS-272: The Apollo Block II ELS auxiliary chute was deployed laterally compared to the vehicle 
flight path, through the opening above the tunnel as the CM dropped from the FHS. Inflation of 
the chute exerted a force that redirected the cover into a separate flight path and subsequently 
slowed the rate of descent of the FHS and took it out of the wake and flight path of the 
Command Module. 

EO-85: The Apollo Project recognized that premature firing of the Apollo auxiliary chute could 
have resulted in an inability to jettison the FHS. Extensive testing verified that the Apollo 
auxiliary chute reliability was sufficient so that its benefits would outweigh its risks. 

FS-273: Comprehensive testing with a boilerplate vehicle was used to verify and validate the 
reliability of the Apollo Block II EES auxiliary chute system because contact of the forward heat 
cover that damages more than one main parachute, main suspension lines, main risers, or main 
harness, was recognized to result in LOC. 

FS-274: The CPAS auxiliary chutes being considered by the project are two 10 lb. ring sails, 
nominally 25.7 ft diameter. For comparison, the two drogue parachutes are nominally 23 ft in 
diameter. 

FS-275: The CPAS auxiliary chutes are installed beneath the drogue mortars and fired by a gun 
simultaneously towards one side of the FBC. 
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EO-86: A preliminary assessment of the CPAS auxiliary chute architectural option suggests that 
the concept of operation is principally to provide additional drag to decelerate the FBC after 
release. Suspended beneath two drogue parachutes, the force from two auxiliary parachutes 
inflating off to one side, at low speed, may not significantly redirect the FBC laterally out of the 
vehicle flight path. Their chief benefit would be to decelerate the FBC relative to the CM. 

EO-87: The FBC will decelerate rapidly after releasing the CM. 

FS-276: According to information in the IDR charts, the terminal q of the FBC suspended by two 
inflated drogues is 1.26 psf. 

EO-88: As discussed in a CPAS Project teleconference in March 2009, the project appears to 
discount the risk of damage to more than one main risers from contact by an FBC that is 
suspended on only two parachutes (any combination of drogue and auxiliary chutes) and is 
falling faster than the suspended CM. The Project rationale is that that risers will be relatively 
lightly loaded at impact. 

FS-277: PTRS 3. 2. 4. 3 requires prevention of propagation of component failures that can result in 
catastrophic hazard. 

FS-278: The table indicates that the project recognizes that ground testing is necessary to verify 
and validate that main d-bags will not suffer damage from contact with CEV structure or FBC 
structure, as they are lifted from their stowed locations. 

FS-279: The table indicates that the project recognizes that ground testing is necessary to verify 
and validate that main risers will not suffer damage from contact with CEV structure or FBC 
structure, as they are deployed from their d-bags. It is not clear if the project recognizes this 
should be system-level ground testing with a geometrically accurate CM mockup. 

FS-280: The table indicates that the project recognizes that ground testing is necessary to verify 
and validate that main canopies and suspension lines will not suffer damage from contact with 
FBC structure, as they are deployed from their d-bags. 

FS-281: The table indicates that the project recognizes that ground testing is necessary to verify 
and validate that for the loosely-attached mains architectural option and loosely-attached pilots 
architectural option, components that attach same to the FBC will not suffer damage from 
contact with FBC structure, as contents are deployed from the d-bags. 

FS-282: The table indicates that the project recognizes that flight testing is necessary to develop 
data needed to estimate the risk of main chute entanglement, regardless of main deployment 
architectural option. 

FS-283: The table indicates that the project recognizes that aerial drop flight testing is necessary 
to develop data needed to estimate the risk of entanglement between drogue parachutes and 
auxiliary parachutes. 
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FS-284: The table indicates that the project recognizes that historical data is available to estimate 
the risk of skipped reefing stage failure. 

FS-285: The table indicates that the project recognizes that the risk of chute deployment failure 
due to bum damage from rapid extraction cannot be solely characterized with historical data, and 
that incorporation of new materials or novel applications of materials, and high packing density 
all compel extraction tests. 

FS-286: For the loosely-attached mains architectural option, the extraction of a main d-bag from 
its stowage sector can be hindered by contact (drag across, slide along or strike against) with CM 
structure. Hindrance of extraction can be followed by a more rapid extraction than nominal. This 
can lead to subsequently more rapid extraction of the contents from the d-bag (riser, suspension 
lines, canopy). This rapid deployment can generate heat from friction that can damage Nylon, 
Kevlar 3 , and Vectran fabric materials. Vectran offers less strength retention at high 
temperatures than Kevlar®. 

FS-287: The table indicates that the project recognizes that historical data exists to characterize 
the risk of failure due to disorderly deployment. 

FS-288: The table indicates that the project recognizes that premature release of a chute is an 
integrated risk, but does not specify how the risk will established. 

FS-289: The table indicates that the project recognizes that the risk of a bag cutter failure can be 
characterized by available NSI data. 

FS-290: The table indicates that the project recognizes that inflation failure can be characterized 
with historical data. 

FS-291: v project recognizes a risk with the loosely-attached mains architectural configuration, 
of snatch loads on the main d-bags handles being high, which can lead to a physical failure 
which results in leaving a d-bag in its stowage location. Mitigations discussed by the project 
included the addition of energy modulators on the bag handles. 

FS-292: In December 2008 and February 2009 versions of the IDR charts, the main risers were 
indicated to be 1.75 inch wide Kevlar® Tape with 8 plies. 

FS-293: In December 2008 and February 2009 versions of the IDR charts, the main harness legs 
were indicated to be 1.75 -inch wide Kevlar® Tape. They were indicated to have 14 plies in 
December 2008 and 18 plies in February 2009. 

FS-294: If a rotation torque limiter is incorporated into the main riser system for either the 
hamessed-mains architectural option or the single point attach architectural option, the three 
involved lengths of Kevlar® tape will be allowed to twist so the vehicle’s RCS can maintain a 
CM orientation with the crew’s feet towards the horizontal direction of travel prior to landing. 
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FS-295: In December 2008, Airborne had manufactured or procured subscale harness legs for 
testing in a Tinius Olsen tensio-meter (twist fixture). The test legs were said to be quarter-scale, 
but shown in the image next to a ruler, to be approximately one inch in width. 

FS-296: In December 2008, tests were being planned to measure tension in sets of subscale 
Kevlar® Tape, while twisted, to characterize strength degradation with respect to number of full 
twists, up to five twists. One twist was defined as 360°. 

EO-89: Three tapes with rectangular cross sections, held in a torque limiter in a triangular 
arrangement at a 120° angle to each other (but not touching each other at the ends when 
untwisted), will touch each other along their lengths at some number of twists that will depend 
on the lengths and the widths of the tapes. Twisting beyond this point will put stresses on the 
tapes that will be difficult to predict and could pose a risk of failure. Torque limiter dimensions 
can be designed to avoid stresses that could damage the tapes, securing ties, or restraining cords. 

FS-297: Between December 2008 and March 2009, stretch testing was being planned to apply 
peak loads to full-scale fabricated Kevlar® harness legs, to characterize their hysteresis curves, 
to verify completed analyses that established that one 16 ft harness leg and two 19 ft harness legs 
would provide the required hang angle at splashdown. 

FS-298: Apex forward deployment of the drogues or the mains is not a requirement. 

FS-299: There are numerous opportunities for damage to Kevlar® tapes and cords expected to be 
used for drogue harness legs, risers, suspension lines, and main harness legs, risers and 
suspension lines, from contact with sharp edges on the CEV and FBC. 

FS-300: The project approach to mitigate these risks is to require large radius edges on any 
protruding or exposed CM or FBC hardware. 

FS-301: The separation of the FIDS prior to initiation of the CPAS system may present a sharp 
edge on the top of the tunnel. 

FS-302: An off-nominal FAS separation could result in the FAS contacting the FBC on its way 
out. 

EO-90: During a Hardware IPT in February 2009, it was noted by a participant that steel risers 
were still carried as a design alternative for CPAS. 

FS-303: According to charts prepared for a brief by CPAS to a Fockheed Engineering Review 
Board in March 2009, high altitude and high Mach tests will be performed with single-drogue 
drop tests. These will not include cluster tests of two drogues. These will not provide information 
about wake effects. 

EO-91: Cannot drop test parachute test cargos from a C-17 above 20,000 ft. 
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FS-304: The unmanned Ares-IY ascent abort flight test will provide data on CPAS parachute 
performance at higher altitudes in the drogue deployment envelope. 

Testing, Drogues Development 

FS-305: CPAS employs 2 Drogue Parachutes, only 1 of the Drogues is required to establish 
Main Parachute deployment conditions 

FS-306: Airborne IDR chart said that the drogues to be used for flight test development unit 
(FDU) will have two-inch wide 2000 lb Nylon ripstops added to the trailing edge tapes of the 
vent, the upper shoulder, and the lower shoulder. 

FS-307: Apollo drogues deployed with risers out of tube first, encased in a foam disk, then the 
packs, with the d-bag mouth facing outwards. 

FS-308: The two Apollo drogues fired at an included angle of approximately 60 degrees. The 
kick load on the Apollo CM would tend push the vehicle apex away from direction of 
deployment of the two drogues, regardless of the vehicle’s initial attitude. From each tube, the 
steel riser came out first, encased in a foam disk, and uncoiled from its foam encasement. The 
suspension lines played out of the d-bag as the pack turned around, and the canopy came out of 
the d-bag last. ELS system designers assumed that the vehicle could be in any attitude at drogue 
line stretch. Each drogue’s line stretch load would tend to pull the CM apex towards the 
direction of line stretch. 

EO-92: The Orion CEV has two three-legged drogue harnesses and two confluence rings. The 
rings are stowed one in each mortar. The included angle between the two mortars is not known to 
the NESC team. Similar to the Apollo system, the kick load on the Orion CM would tend to 
push the vehicle apex away from the direction of deployment of the two drogues, regardless of 
the vehicle’s initial attitude. From each tube, the confluence ring comes out first, then the 
Kevlar® tape riser, then the d-bag. When one or both harnesses go into tension (extracted from 
their stowed location on top of the FBC), the event would tend to pull the apex towards the 
direction of deployment. The suspension lines would play out of the d-bag as the pack turned 
around, and then the canopy would came out of the d-bag last. Each drogue’s line stretch load 
would tend to pull the CM apex towards the direction of line stretch. The vehicle could be in any 
attitude at drogue line stretch. 

FS-309: The project estimated a failure of 1 :333 for “drogue bag separation.” 

EO-93: The 1:333 estimate for “drogue bag separation” failure likely refers to a d-bag not getting 
propelled far enough out to catch the free stream airflow, due to insufficient energy of the 
mortar. 

FS-310: Airborne chart said - Drogues are completely independent. Failure of one drogue due to 
skipped reefing will not affect the other drogue. 
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FS-311: No FBC design detail has been made available about the drogue attach fittings. For the 
single confluence fitting architectural option, there will be one attach bolt per fitting at 60°, 1 80°, 
and 300°, near the top of the FBC. (crew ‘heads up’ is 0°). For the dual drogue confluence fitting 
architectural option, there will be two attach bolts per each fitting at the same three locations. 

The fittings will have to be protected by TPS. 

FS-312: No FBC design detail has been made available about the load path through the FBC 
from drogue harness fittings to the FBC attachment to the CM. The three FBC release 
mechanisms are integrated into CM forward bay gussets at the same three locations (60°, 180° 
and 300°), to react drogue harness leg loads. 

Testing, Mains Development 

FS-313: CPAS employs 3 Main Parachutes, only 2 of the 3 Mains is required to establish the 
terminal descent conditions for a safe landing 

FS-314: Apollo system mains were mortar-deployed in 3 directions, 120 degrees apart, within a 
plane. If all 3 mortars fired simultaneously, the net kick load on the vehicle at mortar fire would 
be zero. If all 3 pilot parachutes pulled all 3 mains out synchronously and all 3 main parachutes 
reached line stretch simultaneously, the net force on the vehicle at line stretch would be zero. 

FS-315: Intentionally blank 

FS-316: There is a risk during main parachute deployment of one canopy becoming a leader in 
initial filling. The leader runs the risk of encountering excessive loads with the initial 
deceleration loads not being shared amongst the other two. 

Trigger Logic 

FS-317: According to Lockheed document CEV-T-078005, reviewed in February 2008, GPS- 
derived altitude and velocity are used to initiation decent and landing phase events, such as FBC 
release, drogue deployment, main deployment, depend 

FS-318: According to Lockheed document CEV-T-078005, reviewed in February 2008, IMU- 
propagated altitude is used as a back-up to GPS-derived altitude. 

FS-319: IMU propagated altitudes could contain altitude errors on the order of tens of thousands 
of feet. 

FS-320: According to charts prepared for a brief by CPAS to a Lockheed Engineering Review 
Board in March 2009, CPAS has decided to use IMU-propagated velocity as the trigger for 
drogue mortar initiation, for ISS reentries. 

FS-321: The velocity to which the CEV must slow to during reentry in order to trigger drogue 
mortar initiation is 676 feet per second (206 meters per second). 
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FS-322: Based on project simulations, the target trigger velocity will result in a drogue 
deployment altitude range of between 45,000 ft down to 32,000 ft. 

FS-323: The FBC release is on a timer, 82 seconds after the drogue mortars are initiated. 

FS-324: A barometric altimeter option is being considered by the project as a back-up but is not 
baselined at this time. 

FS-325: Apollo used a barometric altitude trigger. 

FS-326: The project has not included a manual deployment capability for the initiation of drogue 
deployment or other stages. The Apollo ELS had manual backup capability. 

FS-327: According to charts prepared for a brief by CPAS to a Lockheed Engineering Review 
Board in March 2009, GPS data will be qualified for use after the vehicle becomes operational, 
and will be used for reentries from lunar missions. 

Environmental 

EO-94: Ascent out-gassing could damage the TPS covering the drogue harnesses on top of the 
FBC, creating risk to the harnesses during reentry heating. 

FS-328: A review of CPAS preliminary design details reveal a risk of heat damage to the drogue 
harness legs stowed on top of the FBC covered with TPS, during normal reentry, if the TPS has 
been damaged at any time prior to or during entry insertion. A single fault can damage two 
drogue legs — one from each parachute per the routing scheme. 

FS-329: Textile material properties change with age. 

FS-330: Mortar propellant properties change with age. 

Pad Abort 

FS-331: The requirement for max terminal rate of descent at landing is 33 fps. 

FS-332: The PTRS Para 3.2. 1.2.3 “Full deploy at min altitude” assumes no wind for pad abort. 

FS-333: The PTRS Para 3. 2. 1.1. 4 requires at most 5 seconds between drogue mortar initiation 
and the initiation of FBC release for a pad abort. IDR chart 62 says 0 to 5. Discussion later said 
2-5. 

EO-95: The CM may be unstable at FAS hand-off. The project is performing trades to establish 
test points. 

FS-334: Monte Carlo analyses run in March 2009 show wide attitude and load dispersions for 
pad abort. (Point 7 on the drogue deploy envelope.) 

FS-335: Orion GNC requirements are one failed drogue or one failed main. 
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FS-336: CPAS is changing the PTRS to align with GNC requirement - single chute fault 
tolerant. 

EO-96: A failed main may not be an independent event to a failed drogue. Operation with one 
failed drogue may affect stability which may in turn affect probability of near field contact 
during FBC separation. 
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Appendix C.l. Stakeholder Outbrief of Interim NESC 
Recommendations 2 (September 2009) 


The version of the Stakeholder Outbrief 2 in this Appendix differs slightly from that which was 
approved by the NRB. Figures included to facilitate board member understanding were removed 
in the stakeholder package. Also, backup material was added: a sample Functional Verification 
Matrix and a tutorial, Introduction to Design of Experiments. All are included in this Appendix. 
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Michael Kelly 
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Crew Exploration Vehicle (CEV) 
Parachute Assembly System (CPAS) 
Independent Reliability Assessment 

Stakeholder Outbrief of Interim 
NESC Recommendations 

Assessment of design development and test planning between 
December 2008-August 2009 

Michael Kelly 

NESC Principal Engineers Office 

September 24, 2009 
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Background 


Michael Kelly 


September 24, 2009 


Assessment Objective: 


Identify design and/or process improvement opportunities, assess the robustness of the development test plans, and make 
recommendations that will increase the reliability of CPAS and ensure the success of the integrated system. 


Timeline: 


Month 

12/08 

04/09 

05/09 

05/09-07/09 

06/09 

06/09 

07/09 

09/09 

09/09 

09/09-10/09 

11/09 

11/09 

12/09 

03/10 


NESC Request No: TI-08-00487 


Activity 

Team attended Internal Design Review (IDR) #1 

Team out-briefed Interim NESC Findings (20), Observations (24), and Recommendations(30) 

— Related to architectural options and design development practices that can impact reliability 
Team attended IDR #2 
Assessment hiatus 

Orion Subsystem Design Review (SSDR) 

Integrated Design Assessment Team (I DAT) chartered 

— CPAS, Lockheed and MSL EDL, collaboratively exploring design trade space 
Orion System and Module Review (SMR) 

Team to attend IDR #3 

Team to out-brief Interim NESC Findings (3), Observations (2), and Recommendations (2) 

— Related to development and verification test planning and Design of Experiments (DOE) 

IDAT architecture down-selection expected 
Draft CPAS Master Verification Plan expected 

Team to out-brief Final NESC Findings, Observations, and Recommendations 
— Related to down-selected architecture, test planning and DOE 
Final report complete 
CPAS Preliminary Design Review (PDR) 

This briefing is for status only and does not represent complete engineering data analysis 


} Subject to change 
based on project 
performance 
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Team Listing 
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Interim Recommendation 

Michael Kelly 

Outbriefed in April 2009 

September 24, 2009 


0-5: Review of Gen 1 test reports suggests that in 2007 and 2008 there was a lack of a systematic process in 
establishing the basis for and the conduct of testing. The Apollo Experience Report - Earth Landing System 
(ELS), NASA TN D-7437, (1973), illustrates the great extent of the testing that was necessary to demonstrate 
the overall reliability of the ELS system, to make it suitable for manned flight. It also illustrated the need for 
thorough systems integration and compatibility verification. Adopting a comprehensive systems approach to 
design, development and testing can deliver a robust, reliable system in a cost-efficient manner. 

0-20: To ensure a robust and reliable design, the Apollo Program proved every part number and every 
assembly number by test or analysis to certify the system for man-rated flight. 

F-6: There were no references to application of NASA SP-2007-6105, NASA Systems Engineering Handbook 
or NPR 7123.1A, NASA Systems Engineering Processes and Requirements in the material reviewed by the 
NESC team. 

R-5: Apply a comprehensive systems approach to the design development, analysis, and testing 
efforts. (0-5) 

• Address risks with priority given to those identified by the FTA to have the highest 
uncertainties (“risk balancing”). 

• Include component -level verification tests to aid in tracking requirements compliance 
and risk acceptance/mitigation. 

• Include planned means for verification and validation of simulation models. 
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New Proposed Interim Findings, Observations, 

Michael Kelly 

and NESC Recommendations 

September 24, 2009 


F-21:The CPAS Development Test Plan is derived from a project assessment of perceived or assumed risks. 
The reviewed plan: 

• Does not link to all risks and concerns identified by FTA, FMEA ; and PRA. 

o Some risks have been sequestered into a tab labeled 'off scope.' 

• Lacks precise objectives and success metrics for each proposed test 

o Clear decision metrics are not included to establish when test objectives have been met. 

• Includes configurations (in the "Test Matrix" tab) that illustrate a form of replication, but do not 
appear to be true replicated configurations. 

o The result could be a confounding of multiple factors without the ability to distinguish 
individual factor effects. 

• Shows tests (in the "Test Matrix" tab) that are a fraction of all possible combinations summarizing 
the results of the Development Test Plan approach, rather than a strategic fraction used to define 
the development tests required. 

0-25: Given resource limitations and the complexity and deeply integrated nature of CPAS, traditional, one- 
factor-at-a-time development testing may insufficiently assess performance, environmental factors, and 
interface interactions that can affect system reliability. 

R-31: Consider a statistics-based Design of Experiments (DOE) approach that features integrated, factorial 
test design, to more strategically and comprehensively plan development tests. (F-21, 0-25,0-5,0-20) 

Such an approach would at a minimum include defining: 

• Precise, quantifiable test objectives 

• Mathematical justification of test methodology and resources to support objectives and provide 
required confidence 
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New Proposed Interim Findings, Observations, 

Michael Kelly 

and NESC Recommendations 

September 24, 2009 


F-22: The reviewed draft Verification and Validation Document (V&VD) indicated that CPAS verification tests 
will be derived principally from CPAS requirements. At the time of review, the V&VD did not contain details 
about the depth to which the verification plan will: 

• Implement a methodology that rigorously traces verification tasks (analyses, testing, inspection and 
demonstrations) back to risks, component functions, and concepts of operations, in addition to 
requirements. 

• Include precise objectives and success metrics (pass/fail criteria) for each proposed test. 

• Consider the impact to verification of CPAS components that functionally interface with components 
of other subsystems. 

• Include component-level and system-level special handling requirements as verification parameters. 

F-23: Project personnel indicated that some (unspecified) development test data may be used for 
verification credit, although the draft V&VD indicates it will not. The V&VD indicates an intention to apply an 
"interactive process ... to evaluate and calibrate the analysis tools" during both development and 
verification testing. 

• Development data from the limited number of configurations reflected in the test matrix may be 
insufficient for rigorous and comprehensive model or analysis validation and may have low 
inferential power. 

• Development data generated using Engineering Development Unit test articles cannot be used for 
verification credit if the test articles are not sufficiently representative of flight units. Verification 
test articles must undergo the same quality control inspections as flight units. 

0-26: To create a complete list of necessary verification tasks (analyses, tests, inspections, and 
demonstrations), a robust verification plan should be derived from a full inventory of component functions, 
functional requirements and identified risks. An incomplete component inventory may fail to identify failure 
modes that were not observed on heritage hardware or on previous tests on developmental hardware. An 
incomplete risk inventory may fail to identify relevant risks that can adversely affect crew safety and mission 
success. 

This briefing is for status only and does not represent complete engineering data analysis 
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New Proposed Interim Findings, Observations, 

Michael Kelly 

and NESC Recommendations 

September 24, 2009 


R-32: Create a comprehensive component-based verification plan as a parallel effort, to identify gaps 
and/or redundancies in the current system development test plan and the incipient verification plan. (F-6, 
F-21, F-22, F-23, 0-26) 


A detailed but incomplete component-based verification matrix that is consistent with this 

recommendation is provided as an example of the approach that would include: 

• Systematic decomposition of the CPAS subsystem into components and their functions, including 
all functions that lead to factors that can influence CPAS performance. 

• Identification of interfacing components (from other subsystems) that may influence CPAS 
performance, and their functions. 

• Identification of environmental factors that can influence component performance. 

• Identification of unique handling, processing, and inspection requirements. 

• Inclusion of all risks and concerns identified by FTA, FMEA, and PRA. 

• Derivation of verification parameters traceable to requirements, risks, and concept of operations. 

• Derivation of an inclusive list of candidate verification tasks (analyses, tests, inspections and 
demonstrations) that rigorously trace back to risk analyses, component functional analyses, 
requirements, and concepts of operations. 

• Cross checking with the existing development plan and the draft verification plan, to reveal 
potentially unidentified verification tasks that will be necessary to certify the system for man- 
rated flight. 
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Sample Component-Based Test Matrix 


Michael Kelly 


September 24, 2009 


Qp *) • ' Sample Component Function Derived verification Plan _ NESC CPAS Team Recommendation R-32.xls [Compatibility Mode] - Microsoft Excel 

mmm mm izl s sap ia 



NESC Request No: TI-08-00487 


This biiefing is for status only and does not represent complete engineering data analysis 


8 


NESC Request No.: 08-00487 



• 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

124 of 156 


Sample Component-Based Test Matrix 


Michael Kelly 


September 24, 2009 


Qp A *) ’ • Sample Component Function Derived verification Plan _ NESC CPAS Team Recommendation R-32.xls [Compatibility Mode] - Microsoft Excel 
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Sample Component-Based Test Matrix 
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Functional Requirements 

Environment Description 






Verifies 

4 


CPAS H 

V Description 


Failure Mode 



Verific 

ation Recommendations 


5 


Compon.nl ID 

Functional Requirements 

Environmental Factors 

Level/Reliability (Mot likely. 
Possible. Most likely) 

Verification Parameters 

Inspection 

Analysis 

Component Level 
Testing (Ground 

Testing) 

Syst Level 
Testl Dr 

8 


110 CEV Avionics Interface 
(CFE) 

Power source for initiators 
Control the Drogue Chute Deploy Seq 
Generate Firing Pulse for D Mortar 
Initiate Motor Firing & Deployment 


- Total syst Toss: Possible 

Sensor Accuracy 
Deploy Sequence/logio 
Fault tolerance 


Elect Interlace Analysis 
FMEA/FTA 
Human factors analysis 
Mode/state transition analys 

Interface Phasing/sequence 
EMI/EMC- Spurious firing 


10 

12 

13 

15 


(CFE) (QtyN) 

Transfer electrical energy to the 
Ignite the pyrotechnic cartridges 
Pressurize the drogue mortar and the 
disconnects 

Regulate the gas entering the mortarb 
disconnect 

Contain the parachute pack In the 


Mortar failure to deploy the drogue ( loss 
of 1/N Drogue Chute: partial loss): 

Rupture of mortar breech 

Critical collateral damage 

Possible 

Mortar Performance 
Controlled Firing/timing 
Mortar assem structural 
Integrity 


Structural Analysis 

Unit qualification at Ground 
High Speed Firing Test 


18 



Maintain drogue packing order 

Pressure packing forces 

Failure (disorderly deployment) due to 
erroneous parachute packing : Not likely 

Chute pack integrity 

Packing Quality Inspection 


Fit oheok into mo, u, 

A) Ait drop dros 




Provide orderly deployment of the 
drogue 

Storage environment - 
temp/humidity cycling 

Failure (Chute damage) due to high 
density packing Possible 

Packing workmanship 

X-ray Inspection 


Table extraction 

max height (sin; 

18 


... Deployment Bag (one 

Protect Drogue Chute from 
Environment 

In flight temp/ pressure cyoling 

release due to bag tear open: Not Likely 

Latent damage 

Specialized NDI. ie reefing line 


Mortar ground firing (static) 6 
Mortar ground firing with 


1$ 




Aerodynamic foroes 

Failure (Chute damage) due to hydrazine 
exposure, ammonia exposure, methane 
exposute, enriohed oxygen exposure, 
vibration and shock: Possible 

Bag integrity due to wind blast 

Visual confirmation of bag 
integrity during windblast 


Material 

contamination/compatibility 

B) Ait drop drot 
chute deployme 
max Q (single cl 

20 




Abrasion on FBC 

Damage to bag and chute inside ■ single 
chute loss: Possible 

Deployment design (robustness] 



Deployment at adverse attitude 


21 











22 



Release Chute Harness 

T emperature (excessive heat) / 

Heat (friction) due to rapid extraction: 
Most Likely 

Loading/Stress/Shook 

Visual damage due to deployment 

Strength Test (Statio 6 Dynamic 

C) Air drop dro. 

23 


Riser Assembly including 
130 attaoh/disoonnect fitting 
(one per Chute) 

Load bearing member between the 
suspension lines and the vehicle: load 

Abrasion on CEV 

Entanglement or fail to deploy : Possible 

Orderly Deployment 

2 

1 

!; 

1 


Material 

max Q (two chu 

24 



Attach the drogue and disconnects it 



“ a9ainS,,eP '“ e 





25 

< 


Join multiple risers to a common riser 
leg. equally distribute pull force 

Temperature oycling 

Confluence Ring Damage: Multiple 
rings: Possible 

Structural load 

Manufacturing inspection 

FEA analysis 

Static loading 

D) Air drop drot 
chute deployme 

26 

s 

Chute) 

Provide the equal connection of loads 
from the drogue to the harness / CEV 

Acceleration / shock 

KpSSSr. 




Dynamic loading 

single chute 

27 

a 




bridle legs configuration) 






28 


iso 

i Verification M S 

T ransfer drag force from suspension 
lines to radials 

Temperature / pressure oyoling 

Heat (friction) due to rapid extraction - 
degraded factor of safety: Most Likely 

Loading/Sttess/Shock 

Visual damage due to deployment 

Strength Test (Static & Dynamic 


i f- 

, 

eet2 She*:: 

Abrasion on CEV 

Entanglement or fail to deploy : Possible 

Deployment 



Manufacturing inspection | 

contamination/compatibility 
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Sample Component-Based Test Matrix 


Michael Kelly 


September 24, 2009 
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Sample Component Function Derived Verification Plan _ NESC CPAS Team Recommendation R-32.xls [Compatibility Mode] - Microsoft Excel 
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Sample Component-Based Test Matrix 
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Sensor Accuracy 
Deploy Sequenceflogic 
Faul! roleranoe 

Mortar Performance 
Controlled Firingftiming 


Chute pack integrity 
Packing workmanship 


Bag integrity due to wind blast 


, Deployment design (robustnes 


LoadingfStressfShook 


dingff using 
Structural Analysis 


Packing Quality Inspection 


(-ray inspection 


Specialized NDI, ie reefing line 


Visual damage due to deployment 




Manufacturing inspection 


damage due to deployment 

Verification_M Sheet2 She 


Interface Phasingfsequem 
EMIfEMC- Spurious firing 

Unit qualification at Groun 
High Speed Firing Test 


Fit check into mortar 


Table entraotion 


Strength T est (Static & Dynamic] 


Strength T est (Static & Dynamic] 


A) Air drop drogue 
chute deployment at 
mar height (single 


B) Air drop drogue 
chute deployment at 
man Q (single chute) 


D) Air drop drogue 
chute deployment at min 
height -(PAD Abort) 
single chute 


@Min height (PAD 


C) Full deployment T es 


D) Full deployment T est 
w Failure Cases -W2 
Drogue Chute Ci M2 
Reefing cutter failure, 
eto. (other failure cases) 


CPAS Test Plan 


(Ground Testing) 


Drogue Riser Abrasion Test 


Drogue Confluence Ring Test 


Drogue Harness Deployment 


_ 


Drogue High Altitude 
Performance (Config 1A. ' 
2B.3C) 


Full System PTV (Config 


Drogue Performance 
Ma«Q (Config 1A. 
2A.3C.5B) 
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Backup 
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Backup 


Michael Kelly 


September 24, 2009 


Introduction to 

Design of Experiments (DOE) 

Pete Parker, LaRC 
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Michael Kelly 

Introduction to DOE 

September 24, 2009 


Statistical Design of Experiments 
Parker (NASA LaRC) / N ESC - CPAS Team Intro 

Designed Experiment - Purposeful control of the inputs (factors) in such a 
way as to deduce their relationships (if any) with the output (responses). 

- Our use of “experiment ” is not related to the technology readiness level 


“All experiments are designed experiments; 
the only question is whether well or poorly.” 

A pplicable to: 

•Characterization and Optimization of system performance 
•Test and Evaluation for Verification and Validation 
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Michael Kelly 

Introduction to DOE 

September 24, 2009 


Some Other Experimental Strategies 
Intuition 

- can greatly benefit planning ► Never a sole strategy 

- typically only "discover" what we already believe to be true 

One factor at a time (OFAT) 

- natural, systematic, and widely taught 

- lacks ability to estimate interactions ► Assumes none 

Scenario, best guess, case by case 

- partitioning of easy versus hard experimental conditions 

- results in an arbitrary fraction of all possible combinations 

Do what we did last time 

- could be good or bad 

- low responsibility, high risk in repeating the same mistakes 
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Michael Kelly 

Introduction to DOE 

September 24, 2009 


What is Design of Experiments (DOE)? 

Design of Experiments is: 

•A structured experimentation and testing strategy 
•A collection of tools to design, execute, and analyze experiments 
•Not a replacement forgood science and engineering 

Methodology that features: 

•Systems engineering perspective - emphasizes integration 
• Efficiency with factorial experiments, information-intensive data 
•80+ year successful track-record 

Details of the Experimental Planning Process (Tutorial) 

•Coleman and Montgomery (1993) “A Systematic Approach to Planning for a 
Designed Industrial Experiment”, Technometrics 
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Michael Kelly 

Introduction to DOE 

September 24, 2009 


Fundamental Experiment Design Questions 

Program and Project Definition 

•What are the precise objectives? 

- Are the objectives quantifiable, detectable, measurable? 

- What are we seeking to learn, new knowledge sought? 

•How will we know when we have learned it? 

Technical Risk Management 

• How well do we need to know the answer (precision)? 

- What risk are we willing to accept if we are wrong about or conclusions? 

- What are the consequences if we are wrong? 

Planning and Execution 

• Do the methods support rigorous answers to the stated objectives and risk? 

• Does the allocation of resources support the objectives and risk? 

- Are the resources justifiable and defendable? 


Questions apply recursively in the vertical direction through systems and 
subsystems and horizontally throughout project phases 
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Michael Kelly 

Introduction to DOE 

September 24, 2009 


Some References 


•Some Textbooks and NIST website: 

• Box, G.E.P., Hunter, W.G., Hunter, J.S. (1978), Statistics for Experimenters, John Wiley & Sons 

• Box, G.E.P. and Draper, N.R. (1987), Empirical Model-Building and Response Surfaces, John 
Wiley & Sons 

• Montgomery, D.C. (2004), Design and Analysis of Experiments (6th ed.), John Wiley & Sons. 

• Myers, R.H. and Montgomery, D.C. (2002), Response Surface Methodology, (2nd Ed.) John 
Wiley & Sons. 

• Wu, C.F. and Hamada, M. (2000), Experiments: Planning, Analysis, and Parameter Design 
Optimization, John Wiley & Sons. 

• NIST Engineering Statistics Handbook 

http://www.itl.nist.aov/div898/handbook/pri/section1/Dri1 1 .htm 
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Appendix C.2. Supporting Frequently-Asked-Questions for 
Stakeholder Outbrief of Interim NESC Recommendations 2 

(December 2009) 


The team provided the material in this Appendix and discussed it with the Project in December 
2009, to improve their understanding of material previously outbriefed during Stakeholder 
Outbrief 2 (September 2009). 

NESC CPAS team discussion at the Project MVP Tag-up 

As an extension/reiteration of NESC CPAS assessment team recommendations approved by the 
NESC Review Board and communicated to the project in September 2009, the team suggests 
that all test planning (for verification or development) be started with a clear definition of the 
technical knowledge to be obtained about system performance, rather than starting with a pre- 
determined idea of what testing is acceptable within budget or schedule constraints. 

Test matrices should be based on technical objectives, not perceived resource constraints. 

We recognize the practical constraints that will be necessarily imposed on the magnitude of the 
test programs, and therefore a strategic, efficient testing approach should be developed. This 
approach should defend the resource requirements and quantitatively define the confidence (or 
risk) as a function of test resources. 

To facilitate productive discussion, the team has prepared a list of six FAQs that address issues 
that have been discussed at recent CPAS MVP Tag-up meetings. 

1 . “Why not drop it once under worst case conditions?” 

The determination of worst-case conditions requires (1) an analytical determination of the 
settings of the controllable factors (e.g., altitude), (2) measurement of the uncontrollable 
factors (e.g., atmospheric, winds), and (3) traceability that the test article is representative 
of the actual flight unit. If those conditions are met, then the first drop provides a single 
statistical sample of the worst case with no information about variability in the 
responses (e.g., descent rate) observed. Without multiple samples a data-driven estimate 
of variability cannot be obtained, and therefore a data-driven statement about confidence 
(inversely proportional to variability) in the results is not possible. 

With multiple drops, we obtain replicates of the factor settings (controllable and 
uncontrollable) with multiple test articles to estimate experimental variability, which is 
the variability in the response (e.g., descent rate) when the settings are identical (identical 
within the experimental system’s ability to control and measure). In contrast, repeated 
measurements are obtained from a single setting of the factors on a single test article. 
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Repeats, or sub-samples, provide the ability to estimate measurement noise, which is a 
component of experimental variability (usually a very small component). 


2. “Why not partition a single drop to obtain multiple samples?” 

Partitioning a single drop test provides sub-samples, not replicates, and therefore the 
variability of the test article and factor settings will most likely be underestimated 
resulting in an inflated confidence level. Underestimating the variability can result in an 
inferential error (i.e., conclusion drawn from data) in which we declare that the 
requirement has been met when in fact it is not. 

Employing partitioning a single drop as a data analysis method can provide other 
valuable information, but it is not a replacement for experimental replication. 


3: “Does the CPAS need to perform across a range of values or only at an extreme 
value?” 

Several requirements, such as I.CPAS.CM.133, listed in JSC-63497 refer only to extreme 
values, i.e., max and min values along a range. Listing only the extreme values assumes 
that values falling within the extremes are not dangerous. It also assumes that interactions 
between variables are not consequential. 

Failure to test non-extremes could result in an increase in the probability of mission loss. 
Further, testing only extreme values is a ki n to one-factor-at-a-time testing (OFAT). 

OFAT is an inefficient method for determining the effect of a factor on the system. 
Performing OFAT correctly requires an exorbitant amount of testing resources and fails 
to account for the interactions of one factor with another. Factorial experiments (DOE) 
are the only way to detect interactions. 

For example, the CPAS may perform under an extreme condition for each of two 
variables. However, the CPAS may fail when two variables are jointly set at some values 
below their respective extremes. Given that failure can occur at any value within a range 
of values; all requirements should specify a range of values that the CPAS must perform 
within. 


4: “Why include probability measures for each of the requirements?” 

JSC-63497 does not specify a probability threshold for compliance with the requirements 
listed. This leaves the contractor to interpret how well and how often the CPAS must 
meet a given requirement. 
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5: “Why not center the MVP testing strategy around verification activities?” 

The current MVP testing strategy centers around verification activities. As a result, the 
number of verification activities and types of verification activities are determining 
testing resources. Focus on verification activities as a generator of test runs neglects the 
actual causes of failure for CPAS. Verification activities provide a context and scenario 
for testing the CPAS but are not necessarily linked to the factors that affect CPAS 
performance. 

MVP testing strategy should focus on the factors that affect the ability of the CPAS to 
perform against its requirements. Verification activities should be a secondary concern 
for providing a context in which the performance factors can be varied through their 
required sample space. Care should be taken to minimize the number of verification 
activities while maximizing the number of factors stressed in each verification activity. 


6: “Can the MVP testing strategy meet all of the CPAS requirements within budget?” 

Documentation for the MVP testing strategy does not have a planning matrix listed. 
Without a planning matrix it is unclear as to how verification testing will meet all of the 
requirements within their resources and within their schedule. 

The planning matrix should list, at a minimum: the requirement, CPAS function under 
test, and number of runs. After the planning matrix is built, a DOE matrix could easily 
follow from this construct. An example matrix adopted from “A Systematic Approach to 
Planning for a Designed Industrial Experiment” by Montgomery & Coleman is below. 


Requirement 

Response 

Variable 

CPAS 

Function 

Hold-constant 

factors 

Nuisance 

factors 

Control 

factors 

Number of 
runs 

[I.CPAS.CM.13 

4] 

Probability 
of successful 
release 

forward bay 
cover (FBC) 
release 

Altitude 

Temp 

Wind Speed 

CM total angle 
of attack 

XXX 
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Appendix D.l. Stakeholder Outbrief of Interim NESC 
Recommendations 3 (April 2010) 


Stakeholder Outbrief 
of Interim NESC Recommendations 

Rev 01, 04/12/10 

Project Assessment between 
September 2009 and March 2010 

Crew Exploration Vehicle (CEV) 
Parachute Assembly System (CPAS) 
Independent Reliability Assessment 

(TI-08-00487) 

April 12, 2010 

Mr. Michael Kelly 

NESC Principal Engineers Office 
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November 2008 — Stakeholder Request 

“Review the reliability analysis of the CPAS in the context of the existing design and planned 
developmen t program and make recommendations for improving either (the design or the planned 
development program), if appropriate. Identify design and/or process improvement opportunities to 
increase the overall reliability of the CPAS as well as to ensure the success of the integrated (CPAS) 
system. Of particular interest is the planned development test program due to its value in uncovering 
design flaws contrasted with the cost and resources required. Striking the proper balance between 
reliability enhancing tests and total project cost and schedule is important for the success of the 
Program. ” - Steve Altemus 


Notes to Stakeholder 


The 23 Interim NESC Recommendations herein (R-33 through R-55) are directed towards the 
CPAS project, unless otherwise indicated. These are interim recommendations, consistent with 
the scope of the request. Those considered top-priority are underlined. 

All previous findings, observations, and interim NESC Recommendations are included in 
backup material. 

A final report will be delivered in June, 2010. Bulleted information seen throughout this 
document is provided for stakeholder clarity, and will ultimately appear within narrative in the 
final report. 
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I. DESIGN -DEVELOPMENT-RELATED INTERIM NESC 

RECOMMENDATIONS 

F-24: The project choice of segmenting the Forward Bay Cover (FBC) into six airbag-jettisoned 
panels appears to have been made without detailed consideration of certain key aspects. 

• Fail-safe requirements 

• Airbag load reaction on the main packs 

• Panel separation line features 

• Volumetric requirements 

• Panel release velocity uncertainties 

• The effect of residuals from mild detonating cord (MDC) detonation on susceptible 
components in the compartment. 

F-25: FBC panel post-jettison trajectory analyses did not include important effects. 

• Variation in airbag thrust vector direction 

• Air flow around the CM at off-nominal CM attitudes 

• Panel tumbling and rolling 

• The range of potential panel ballistic coefficients resulting from a variety of airbag 
inflated shapes or shape differences of the panels that cover the drogue mortar bays 

F-26: An analysis model of undemonstrated validity was used with a set of simplistic 
assumptions to provide translational trajectory predictions of jettisoned FBC panels to support 
design trade decisions and conclusions: 

• The change from a monolithic FBC to a six-panel, segmented FBC 

• The preference of six panels versus fewer, larger panels 

• The conclusion that the panels’ terminal velocity would be ~92 ft/sec 

• The conclusion that the panels’ required jettison velocity was 100 ft/sec 

F-27: FBC panel trajectory analyses were conducted for nominal reentry but not for aborts. 

F-28: No multi -body trajectory analyses were conducted of dispersed relative trajectories of FBC 
panels, drogue chutes, pilot chutes, main chutes or other liberated components. 

F-29: The risk and consequences of near-field contact between FBC panels and parachutes have 
not been rigorously assessed. 

• During descent after reentry, a short interval is planned between FBC panels’ jettison and 
drogue mortars’ firing to reduce the risk of CM angular-rate buildup, but this may 
introduce the risk of a drogue parachute being fired into and contacting a jettisoned panel. 

• Following launch abort system (LAS) handoff after an abort, a short interval is planned 
between FBC panels’ jettison and pilot mortars’ firing to reduce the risk of CM angular- 
rate buildup. However, this may introduce a risk of a pilot parachute being fired into and 
contacting a jettisoned panel. 
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F-30: The risk and consequence of far -field contact of FBC panels with parachutes have not been 
rigorously assessed. 

• FBC panel jettison airbags must provide positive separation of all six panels from the 
CM, drive them outside the deployment radius of any of the parachutes, and set them on 
flight paths that will not intercept the CM on its parachutes. 

• Jettison may occur in a complex air stream that is highly dependent upon capsule 
orientation relative to the wind vector. 

• The probability of any one jettisoned panel (out of a set of six) contacting a parachute is 
greater than the probability of a single monolithic cover contacting a parachute. 

0-27: Analysis tools used by the military to assess aircraft survivability in hostile environments 
may be helpful for analysis of far-field contact. 

• Reference: The Fundamentals of Aircraft Combat Survivability Analysis and Design, 2nd 
Edition, Robert E. Ball, Naval Postgraduate School, American Institute of Aeronautics 
and Astronautics (AIAA) Education Series C 2003, 2nd Edition, 889 pages, mixed media, 
ISBN-10: 1-56347-582-0, ISBN-13: 978-1-56347-582-5. 

• http ://aircraft- survivability .com/ 

R-33: Assess the risks (likelihood/consequences) of near-field re-contact from firing a 
drogue or pilot parachute into a jettisoned FBC panel, and of far-field re-contact of a panel 
with any drogue, pilot, or main parachute component, by conducting a comprehensive 
development test and analysis program. ( F-24 , F-25, F-26, F-27, F-28, F-29, F-30, 0-27) 

F-31: Project analyses of the risks and consequences of unsuccessful panel jettison due to either 
MDC fail or airbag fail were not shown. 

• A failure of one of the panels on a drogue mortar sector to jettison may result in the 
improper deployment, or failure to deploy, of one drogue parachute and the improper 
deployment of, or failure to deploy, of one pilot parachute (and consequently one main 
parachute). 

• A failure of the panel to jettison from the sector with the CM Uprighting System (CMUS) 
tanks may result in the improper deployment, or failure to deploy, of one pilot parachute 
(and consequently one main parachute). 

• A failure of one panel to jettison from one of three sectors with main parachutes may 
result in the improper deployment, or failure to deploy, of one main parachute; if in this 
event the pilot riser physically releases the stuck panel at line stretch, this would pose 
increased risk of main parachute damage. 
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• Retained FBC panels are apparently not designed to break away or fail by drogue or pilot 
parachute deployment. 

0-28: Aircraft ejection-seat escape systems that rely on MDC to rupture a cockpit canopy often 
include physical strikers mounted on the upper-most position of the seat as a fail-safe feature. 

R-34: Assess the risks (likelihood/consequences) of any FBC panel failing to separate from 
the CM by conducting a comprehensive development test and analysis program. ( F-31 , 

0-28 ) 

F-32: Computer algorithms for panel jettison and subsequent firing of mortars are poorly 
defined. 

• The timing sequence and control of FBC panel deployment should be considered a risk 
mitigation design parameter. 

• Algorithms must be sufficiently defined to enable project engineers to understand the 
event sequence. 

0-29: Initial trajectories and motions of FBC panels will be sensitive to variations that will be 
inherent in several closely sequenced initial events. 

• MDC detonation events 

• Initiation of airbag inflation 

• Rate of airbag inflation 

• Push-off force 

R-35: Consider implementing an error margin budget that is derived by Monte Carlo 
simulation, in the FBC deployment design and analysis effort. {F-32, 0-29 ) 

• An FBC deployment error margin budget could include (with example values): 

o Timing mismatch between FBC separation and airbag inflation (ultimately 

effective delta-v from airbags) (e.g., 0 + 0.05 sec 3-sigma, Gaussian distribution). 

o Airbag inflation rate and panel stability (e.g., 5 +/- 0.10 m 3 /sec 3-sigma, Gaussian 
distribution). 

o Time allowed in free-fall between FBC jettison and chute deploy (e.g., 1 +/- 0.1 
sec 3-sigma, Gaussian distribution). 

o Atmospheric density (e.g., +/- 0.001 kg/m 3-sigma, Gaussian distribution). 

o CM attitude at FBC separation and chute deploy (e.g., 180 +/- 50 deg 3-sigma, 
Gaussian distribution). 
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• An error budget could be interrogated: 

o Do the budgeted dispersions (uncertainties) meet the design requirement? 

o Can the design requirement (e.g., acceptable range from FBC at parachute deploy) 
be changed to accommodate the budgeted dispersions (uncertainties)? 

• Mars Science Laboratory (MSL) Entry, Descent, and Landing (EDL) designers employed 
an error margin budget to various operational phases, as described in: Mars Science 
Laboratory Entry, Descent, and Landing Triggers, Kipp, D., et al. (2006), Institute of 
Electrical and Electronics Engineers Aerospace Conference (IEEEAC) paper #1445, 
Version 2, Updated 2006:12:27. 

R-36: Validate the aerodynamic trajectory analysis by conducting appropriate wind 
tunnel, ground, and/or flight tests. (F-26, F-28) 

• Consider subjecting a family of test panels that envelopes a best-guess range of panel 
dimensions, to vertical wind tunnel testing or free fall from an aircraft; investigate panels 
with variously deflated airbags in this same manner. 

• Characterize the nature of terminal descent of the six panels (stable, metastable, 
unstable). 

• Verify the assumptions/analysis of flight stability and ballistic coefficients. 

• Conduct full 3D multi-body Monte Carlo trajectory analyses using dispersed 
aerodynamic parameters that encompass the FBC panel testing campaign’s derived 
uncertainty. 


F-33: The CPAS main parachute stowage bay geometry is more restrictive of unhindered 
extraction than was the heritage Apollo Earth landing system (ELS). 

• The CPAS forward bay gusset geometry provides a 60-degree sweep of unhindered 
extraction, compared to 90 degrees for the ELS. 

• The ramp on the upper back side of the three CPAS main-deployment bags will hinder 
upward extraction above the angle of the ramp. 

F-34: The project decision to classify the risk of deployment bag contact with forward bay 
features during extraction as “off scope” in the development test matrix was not based on test 
data. 

• Consequences could include deployment bag extraction failure or extraction delay and 
damage to packed main parachute components. 

R-37: Assess the risks (likelihood/consequences) arising from main parachute pack 
assembly contact with CM features during extraction by performing analysis and 
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conducting a comprehensive development test and analysis program using a representative 
forward bay mock-up. (F-33, F-34 ) 


F-35: Some of the main parachute retention options being considered expose the daisy-chain 
locking loops and their associated lanyards to risks of abrasion and heat damage. 

F-36: The latest reviewed main parachute retention system (March 2010) exhibits rigging 
complexity that introduces new risks of failed or delayed extraction of a main parachute pack. 

• No mechanism was shown for the left/right pilot riser halves to impart forces to unzip 
their associated daisy-chain loops; risers would require one-for-one integration with each 
locking loop to pull each loop through its associated grommet. This concept has no 
apparent precedent. 

0-30: Parachute extraction, deployment, and inflation have historically required testing because 
these events are difficult to analyze. 

R-38: Conduct development ground testing to assess retention system options before 
submitting the preliminary design to aerial drop tests. (F-35, F-36, 0-30 ) 

• Ground tests could include a series of static and dynamic strip tests at various pull angles 
on a representative forward bay mock-up. 

F-37: The system of corsets and beckets on the outer deployment bag surface of the current 
iteration of the main parachute retention may insufficiently support the convex-curved upper- 
outer edge of the main parachute pack. 

0-3 1 : Inertial forces may shift a pack in its retention system, altering its top and outer surfaces 
and particularly affecting its curved upper-outer edge. Such movement or distortion could allow 
contact of the deployment bag with the FBC inner mold line (IML), consequently damaging 
parachute components. 

0-32: The lock/loop release concept on the current iteration of the main parachute retention 
system appears unnecessarily complex in that it requires pilot risers to un-loop each link during 
deployment. 

• Diverges from the Apollo model by restraining the packs along their side edges instead of 
along their top and bottom edges. 

R-39: Assess design options and risks (likelihood/consequences) of failure of the main 
parachute deployment bag corset-and-becket restraints by conducting development tests of 
a variety of restraint schemes under vibration and shock. (F-37, 0-31, 0-32 ) 

• Pay particular attention to risks along the convex-curved upper-outer edge of the main 
parachute deployment bags and consider incorporation of stiffening material. 
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0-33: Movement internal to a main parachute pack can result in premature reefing line cutter 
initiation, as may have contributed proximally to the Ares 1-X test parachute performance 
anomaly. 

R-40: Ensure the adequacy of the cutter actuation system design load safety margins to 
preclude premature reefing line cutter initiation during packing, transport, or flight, while 
ensuring actuation during the dynamic conditions of deployment. (0-33) 

• Consider the cutter actuator, initiation lanyard, attachment loops, safing ties, and stowage 
procedure. 


F-38: The torque limiter design feature for limiting roll torque has no precedent and can induce 
failure modes into CPAS that will require extensive deployment testing. 

0-34: The requirement to use the roll control system (RCS) for touchdown roll orientation 
control appears to be a remnant from the time when the CM was being designed to withstand 
land landings. The RCS is being relied upon to limit structural loads during water landings. The 
use of the RCS after FBC jettison may adversely affect the reliability of CPAS, by introducing 
risks of burning or oxidizing damage to textile materials, especially at high CM angular rates and 
attitudes. 

0-35: Integrated risks and consequences associated with the RCS do not appear to have been 
comprehensively assessed. 

R-41: The Orion Project should consider chartering an Integrated Design Assessment 
Team (IDAT) to conduct a comprehensive assessment of CM roll control effectiveness at 
limiting landing loads on the vehicle. Include representatives from all CM subsystems that 
interface with or are dependent on the RCS function, including CPAS. (F-38, 0-34, 0-35) 

• The assessment scope could include: 

o The overall feasibility and ramifications of using the RCS for touchdown roll 
control 

o Assessment of the risks (likelihood/consequence) versus benefits to CPAS and 
other subsystems 

o The impact of prohibiting the use of the RCS once the FBC panels are deployed 

o The impact of a requirement to not dump RCS fuel in any direction where heat, 
fuel, or oxidizer can reach any part of the parachute system 

o Inclusion of a deployable metallic torque limiter in the CPAS system 
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o Design of the CM structure for water impact at worst-case combinations of water- 
surface conditions and vehicle-landing attitudes 

o The risks of landing with fuel in the RCS tanks 

o The effects of parachute oscillation 

o The ability to sense CM drift direction 

o The ability to sense water- surface conditions beneath the CM prior to landing 

o The methods to determine which heading to take to impact a dynamically 
changing wave slope just right 

o RCS command sequencing 

o The extent and complexity of an adequate development and certification plan for 
the RCS 


0-36: The 2009 ID AT outer mold line (OML) change provided increased forward-bay volume 
for packaging CPAS components, but growth during forward development should be expected. 
Main parachutes may grow in size to reduce landing loads. CM weight increases may drive 
other increases in volume requirements. Main parachute retention locking loops, flaps, 
reinforcing bars, grommets, corsets, and beckets do not appear to be included in volume accounts 
for forward bay sectors where the main parachutes are stowed. The immaturity of the routing 
scheme for the lines that will secure the inflated CMUS bags may adversely impact available 
volume for CPAS. 

Reiteration ofNESC Interim Recommendation outbriefed in April 2009: 

R-3: Evaluate the use of a volume budget for the forward bay to manage main parachute 
pack volume growth before and after PDR. (F-l, F-2, 0-3, 0-36) 


NESC Request No.: 08-00487 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

08-00487 

Version: 

1.0 

Title: 

CEV Parachute Assembly System Independent 
Design Reliability Assessment 

Page #: 

147 of 156 


II. PRA-RELATED INTERIM NESC RECOMMENDATIONS 

F-39: Failure estimates in the CPAS Probabilistic Risk Assessment (PRA) have evolved with the 
architecture but have never completely or accurately reflected CPAS risks. 

• The driving failure estimate in December 2008 was based on inapplicable data from solid 
rocket booster (SRB) experience. 

• Mid-2009 failure estimates were based on engineering judgment. 

• Subsequent failure estimates (and uncertainty estimates) were based on the results of a 
dubious expert elicitation exercise. 

• CPAS PRA input values at all stages have been used for computations of CPAS 
contributions to Orion’s risk of loss of crew (LOC). 

F-40: Between April 2009 and March 2010, few ground tests were conducted to generate data for 
PRA estimates, as previously recommended. 

F-41: Risk- informed design decisions have been made based on PRA models that have not been 
verified and validated. 

0-37: Early PRA failure estimates are predicted, not demonstrated, but they ultimately require 
some verification of driving assumptions by analysis that has been anchored by some limited 
testing. 

R-42: Include the source (e.g., historical, test, analysis, expert elicitation) and a clear 
explanation of the veracity of all CPAS PRA estimates when provided to the Orion Project 
for use in overall LOC summaries. (F-39, F-40, F-41, Q-37) 

R-43: The Orion Project should establish guidelines for generating PRA failure estimates 
for use on all subsystems, whether contractor-furnished equipment (CFE) or government- 
furnished equipment (GFE). (F-39, F-40, F-41, 0-37) 


F-42: The methodology employed in the CPAS expert elicitation exercise assumed that the 
events were all independent, but some were dependent. 

F-43: The methodology employed in the CPAS expert elicitation exercise assumed that the 
events were comparable, but experts were asked to compare input events at disparate levels. 

R-44: Consider applying the Analytical Hierarchy Process (AHP) or a similar decision- 
ranking technique, to event sets that are truly independent and comparable, in any future 
expert elicitation exercise. (F-42, F-43) 


F-44: The response data from the expert elicitation exercise exhibit large variability. 
• The large variability between experts: 

o Suggests lack of agreement among the experts 
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o Indicates problems with the elicitation protocol, including the collection of events and 
their precise definition, and/or the analysis approach 

o Impugns the validity and applicability of the results 

o Makes the use of the results difficult to defend 


F-45: Deleting PRA failure events associated with the architecture change renders the current 
expert ranking inapplicable. 

• Experts used in the elicitation exercise considered the “Harnessed Drogues and 

Monolithic FBC” architecture prior to the change to the “Modified Apollo” architecture. 

0-38: A cache of heritage Apollo ELS test and reliability reports has been located and will soon 
be retrieved by the project. 

R-45: Discontinue using results from the existing expert elicitation exercise for CPAS 
design decisions or for PRA/LOC estimates until failure estimates are revised to reflect the 
current architecture and the cause of large variability from that process can be 
determined. (F-44, F-45 ) 

R-46: Utilize applicable data from the geometrically similar Apollo Program ELS to 
generate estimates for applicable failure estimates or conduct tests and analyses to generate 
new PRA data. (F-44, F-45, 0-38 ) 


0-39: CPAS may gain insight into the “Modified Apollo” architecture reliability by conducting a 
reliability growth analysis of the Apollo ELS test data. 

• A reliability growth analysis/trending analysis of the original Apollo ELS would provide 
a baseline for present-day development. 

• Reliability growth methods indicate progress toward system reliability goals during a 
development program and provide management with a means to detect adverse (and 
positive) trends and proactively effect programmatic adjustments. 

• A programmatic reliability growth analysis would use calendar time and programmatic 
failures (e.g., failure to meet schedule, requirements, or test objectives). 

• As CPAS components are primarily ‘one-shot’ devices, a growth analysis to derive 
failure or reliability data will require a different approach (e.g., plotting sequential test 
failures versus tests run for both component- and system-level tests). 
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• An example reliability growth application for a NASA space instrument is available in 
the backup material. 

R-47: Consider performing a reliability growth analysis using Apollo ELS test data. (0-39) 


0-40: Based on similarity, the Modified Apollo architecture will have a comparable number of 
risks driving its development program as did the Apollo Block I ELS. 

• Block I (early development) aerial drop tests accounted for 76 percent of all ELS aerial 
drop tests conducted. 

• Approximately 80 percent of ELS development tests were driven by the abort conditions. 

F-46: The Project has conducted few system-development tests supporting the various design 
concepts it has vetted. 

F-47: Ground and air-drop development testing should be better integrated into the overall 
design effort. 


F-48: At IDR3, development tests were discussed for use for qualification credit. F-23 


III. ANALYSES-AND-TESTING-RELATED INTERIM NESC 
RECOMMENDATIONS 

F-48: At IDR3, development tests were discussed for use for qualification credit. F-23 
R-48: Apply development test results for qualification credit only if the configuration 
unambiguously represents the qualification configuration and this representation has been 
rigorously documented. (F-48) 


F-49: The CPAS development test schedule is ambitious, with tests planned every 2-3 months 
starting late in 2010. 

0-41: Resource (cost and schedule) constraints appear to drive testing activities and may have 
adversely impacted the sufficiency of tests conducted to date. The test team appears to be one- 
deep in some skills, and may not be capable of meeting the test rate, or flexibly managing the 
impact of test failures (even minor failures). 

R-49: Consider reorganizing the development test conduct team to allow multiple test 
subteams to conduct parallel activities. (F-49, F-50 ) 
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F-50: A draft DOE test plan was created by a project statistician after NESC Interim 
Recommendation R-31 was outbriefed, but the plan was not incorporated into the development 
test planning process. 


0-42: Insufficient photographic and riser loads test instrumentation hindered investigation of 
parachute failures that occurred during the Ares 1-X flight test. 

R-50: Include photographic and test instrumentation on all aerial drop tests, sufficient not 
only to meet the requirements for nominal performance, but also to assist determining 
foreseeable failure causes. (0-42) 


F-51: Statistical results from parametric analyses of un-shown validity have been used to inform 
design decisions. 

R-51: Recognize and convey to decision makers the maturity of analytical models and the 
resulting uncertainties prior to their use in supporting design decisions. ( F-26 . F-51) 


F-52: DCLDYN does not have the capability to model clustered canopies as independent bodies. 

F-53: The fraction of cluster load-sharing shown at IDR3 was not correct for the system 
presented. 

• The load share fraction used was based on one Apollo mains test point, and had been 
chosen by the Hardware Integrated Product Team (IPT) (as detailed in the IDR3 backup 
charts). 

0-43: The fraction of load sharing has a significant and important effect on the structural 
analysis of the parachute and the hardware connections to the CM and should be tracked during 
development. Cluster performance and load-sharing data over the range of deployment 
conditions is needed early in the design process. 

0-44: Various simulation models are available for modeling parachute clusters. 

• The NASA LAS team conducts multi-body MC analysis using four different simulation 
tools: Decelerator System Simulation (DSS), Program to Optimize Simulated Trajectories 
(POST), Advanced NASA Technology Architecture for Exploration Studies 
(ANTARES), and OSIRIS. 

• DSS uses three degrees of freedom (3D0F) multi-body parachutes that are independent 
of the capsule and other parachutes in the cluster. The three-chute DSS cluster modeled 
during ID AT remains unvalidated. 
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• POST uses 6DOF multi-body parachutes that are independent of the capsule and other 
parachutes in the cluster. The POST simulation multi-body model has been partially 
validated per NASA TM-2002-21 1634. The 6DOF aerodynamics is not known for 
CPAS, and therefore POST uses scaled SRB parachute aerodynamic data. 

• ANTARES and OSIRIS share common simulation frameworks and the same multi-body 
model. 

R-52: Develop a drag model to accommodate multiple bodies in a shared environment that 
represents a chute cluster such that MC runs can assess variations in inflation times and 
opening loads between chutes. ( F-52 , F-53, 0-43, 0-44 ) 

IV. REQUIREMENTS-AND-VERIFICATION-RELATED 
INTERIM NESC RECOMMENDATIONS 

F-54: The Project Technical Requirements Specification (PTRS) does not define pass/fail criteria 
quantitatively, nor require an explicit statement of test suitability, assumptions, or statistical 
confidence in the test and/or simulation data and analysis. 

R-53: Revise the PTRS to unequivocally ensure verifiable pass/fail metrics that require a 
quantitative and defendable development testing approach and analysis. (F-54) 

• State what needs to be known, how well it needs to be known, and how it will become 
known that it has been learned. 

• Reference EA-07-005, Verification of Probabilistic Engineering Requirements Prepared 
for Constellation Chief Engineers Forum by Verification of Probabilistic Requirements 
Team , for format of the requirements. 

• For example: “The CPAS will ensure with XX percent statistical power at an effect size 
of X.X m/s that the CM will not exceed 10.7 m/s” or “The CPAS will ensure with 90 
percent confidence that the 0.3 -percentile (3 sigma) of the strength of component A 
exceeds X ft-lbs.” 


F-55: The draft Master Verification Plan (MVP) appears to emphasize aerial drop tests over 
ground tests. 

• Integration of verification activities is forward work. 

R-54: Implement a comprehensive verification process that is linked to the requirements 
revised per R-53. (F-55) 
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• Emphasize a bottom-up test and verification approach over system-level drop tests. 
Verification activities should be performed at the lowest level possible and built up to 
mitigate the unnecessary risk and control all external effects. For example, the riser 
assembly mechanical strength qualification can be done as a component level test versus 
during an all-up system drop test. 

• Develop a test matrix based on the most probable worst-case flight conditions and 
environmental factors (on a bad day/worst case), clearly state those conditions in 
reporting the results, and restrict acceptable flight conditions as limited to those that have 
been tested. The project seeks to “test as you fly and fly as you test” but it is often 
impractical to develop a test matrix that will encompass all external environmental 
variables and interactions between its subassembly components, especially for a system 
as complex as CPAS. 

• Use statistical DOEs in all testing levels (component to flight) to optimally use resources 
for requirement verification (PTRS revised per R-54). 


F-56: The CPAS Project’s use of statistical assumptions, methodology, and analyses has not 
been consistently rigorous or defendable. 

R-55: Integrate statistical expertise in the decision-making process throughout the design, 
development, and testing processes. (F-50, F-56) 

V. LESSONS LEARNED FOR FUTURE PROGRAMS AND 
PROJECTS 

0-45: The ID AT work and the Lockheed Forward Bay Technical Interchange Meeting (TIM) 
addressed many CPAS integration issues. LRS Forward Integration Team (FIT) involvement in 
CPAS integration activity will benefit the project. However, complex reporting lines, roles, and 
responsibilities that arise from CPAS being GFE may pose risks to designing a well-integrated 
and reliable subsystem. 

0-46: During Apollo, the ELS organization was responsible for the total upper deck Interface 
Control Document (ICD), allowing them to control anything that could interfere with parachute 
function. 

LL-2: Developers of parachute architectures for recovery of human-rated space vehicles 
should assign control of the parachute compartment ICD to the parachute system 
development team. (0-45, 0-46 ) 
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Appendix D.2. Supporting Example of Reliability Growth Trending 


The following backup material was provided to the Project with the Stakeholder Outbrief of 
Interim NESC Recommendations 3. 

BACKUP ITEM: EXAMPLE SUPPORTING INTERIM R-47 

An example application for a NASA space instrument is provided that used reliability growth 
trending during development._The following graph is a Crow-AMSAA plot (so-named for Dr. 
Larry Crow and the U.S. Army Materiel Systems Analysis Activity), aka a CA plot, or a 
reliability growth plot, of this instrument during integration and test. The inflections (slope 
changes) are points at which failures occurred, fixes implemented, and testing continued. After 
several failures occurred “post-PER,” the program stood down, revised their processes, and 
implemented other fix measures. The slope change from 2 (degradation, or “negative” reliability 
growth) to 0.14 (excellent reliability growth) indicated that the stand-down and changes 
implemented were effective in reversing the prior adverse trend. 



Reliability growth of a space Instrument undergoing T-A-F (test-analyse-fix). 

Italic numbers adjacent lines are fit slopes, indicating growth (<1) or degradation (>1). 

Instrument has operated last - 1400 h failure free since a stand-down. 

The following graph is a mean-time-between-failures plot derived from the CA plot. It shows 
reliability and uncertainty trends, including confidence intervals. Similar plots for failure rate 
are also available. 
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Operating - time (cum. hours) 


Mean-time-between failures derived from the reliability growth plot. 
Confidence intervals are shown (90% total, or upper and lower 95%), and 
are available also for derived failure rate. 
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Appendix D.3. Supporting Example of Potential Problems with 

OFAT Testing 


The following backup material was provided to the Project with the Stakeholder Outbrief of 
Interim NESC Recommendations 3. 

BACKUP ITEM: EXAMPLE OF PROBLEMS THAT CAN ARISE 
WITH ONE-FACTOR-AT-A-TIME (OFAT) TESTING 

Consider the following experiment where the engineer is interested in determining the values of 
factors x and y that produce the highest stress. Suppose we fix factor y at 155 (the nominal 
value) and perform four tests at different levels of factor x - say, .5, 1.0, 1.5, and 2.0. The results 
are shown in Figure 1. This figure indicates that the maximum stress is achieved when factor x is 
about 1.3. 



Figure 1: Stress versus factor x with factor y constant at 155 


To determine the effect of factor y fix factor x at 1.3 (the apparent optimal value) and perform 
six tests at different levels of factor y - say, 140, 150, 160, 170, 180, and 190. The results of 
these tests are plotted in Figure 2. The maximum stress occurs at about 165. Therefore we would 
conclude that the worst case stress occurs at x = 1.3 and y = 165 resulting in a stress of about 9. 
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Figure 2: Stress versus factor y with factor x constant at 1.3 


Figure 3 displays the contour plot of stress as a function of x and y with the one-at-a-time tests 
shown on the contours. We now see that the one-at-a-time testing has failed here, as the true 
worst case is over 50% higher (greater than 14) and occurs when x = .7 and y = 185. 



Figure 3: Stress experiment using one-factor- at- a- time method 


The one-at-a-time testing has failed here because it failed to detect the interaction between the 
two factors. Factorial experiments (DOE) are the only way to detect interactions. In addition the 
one-at-a-time method is inefficient; it requires more tests than a factorial, and there is no 
assurance that it will produce the correct results. 
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